Hackers Distribute RAT via Tampered Exodus Crypto Wallet Installer
Attackers are distributing a modified Exodus cryptocurrency wallet installer that silently installs a remote access trojan (RAT), posing a significant risk beyond cryptocurrency theft.
Cybercriminals have been observed distributing a malicious installer for the popular Exodus cryptocurrency wallet, which secretly installs a full remote access trojan (RAT) onto victim systems. The tampered MSI package is designed to mimic the legitimate wallet but crucially prevents its window from appearing, while a hidden payload executes in the background. This sophisticated attack vector, identified by researchers at Huntress, has targeted at least four organizations between late July and mid-August 2026, with some compromises occurring in rapid succession, highlighting the campaign's efficiency.
The malicious installer, disguised as a "Background Service" from "Apple Inc." in its metadata, managed to evade detection by 76 VirusTotal engines. Huntress found that the campaign utilized various social engineering tactics, including disguised files like fake PDFs with a .pdf.js extension and ZIP archives containing hidden JavaScript files. Upon opening these lures, victims would see a decoy document while the malware silently installed.
Once executed, the altered Exodus installer replaces only three of the legitimate wallet's 1,973 files. A modified script prevents the wallet interface from displaying, focusing, or centering, while another altered file acts as a loader, decrypting a substantial 10 MB Windows payload directly into memory. This leaves the victim unaware of any running wallet application, even as a seemingly legitimate Exodus process appears in their task manager.
The RAT's capabilities extend far beyond typical cryptocurrency theft. Its modular design allows it to steal browser credentials and cookies, execute arbitrary commands, move files, provide remote desktop access, and even transform a compromised machine into a proxy. This broad functionality can be leveraged for account takeover, extensive surveillance, and deeper lateral movement within a compromised network.
Interestingly, the malware was observed using Azure Table Storage for tasking and results, deviating from traditional command-and-control (C2) server reliance. While it also supports WebSockets and includes numerous configured lookalike hosts, these additional communication channels were not actively used during testing.
To maintain persistence, the installer places the trojanized wallet in a per-user AppData directory and initiates it via explorer.exe, mimicking a user-initiated launch. It then establishes a scheduled task named "ExdBackupTool" to restart the malicious Exodus process hourly. Additionally, an "INetHealth" task is created to clear user proxy settings and refresh internet configurations, potentially forcing traffic to bypass corporate proxies.
Organizations that fall victim to this attack should treat the affected device as a full interactive compromise. Immediate steps should include isolating the host, thoroughly reviewing other user profiles, and removing the malicious directory and scheduled tasks. All saved passwords, browser cookies, and active sessions should be considered compromised, and defenders should revoke sessions and rotate credentials from a clean device.
Defenders are advised to monitor for Windows Script Host activity originating from download folders, Electron applications running without a visible window, and any software launched from AppData via explorer.exe. Enabling visible file extensions and educating users to avoid opening JavaScript files disguised as documents are crucial preventative measures. The combination of stealthy installation, broad RAT capabilities, and evasive C2 infrastructure makes this campaign a significant threat.