A sophisticated malware campaign has abused a trojanized installer for the legitimate Exodus cryptocurrency wallet to deploy a modular remote access trojan (RAT) capable of stealing browser credentials, session cookies, and extension data.
The campaign prioritizes long-term interactive access over direct cryptocurrency theft, combining hidden VNC, SOCKS proxying, file management and browser-data theft in an unusually stealthy package.
Between late July and mid-August 2026, Huntress identified compromises at four unrelated protected organizations. Three victims were affected within 85 minutes on August 18, using an installer created only a day earlier.
The speed of delivery and rapid payload rebuilds indicate an active operation rather than opportunistic reuse of an older malware kit.
The intrusion begins with a JavaScript lure disguised as either a PDF document or a software update contained in a ZIP archive.
In one route, victims download files with a .pdf.js double extension, which can appear as harmless PDFs when Windows hides known file extensions.
Opening the file launches Windows Script Host, displays a legitimate decoy document hosted on trusted infrastructure, and silently installs an MSI package through msiexec.
A second observed route used a ZIP file containing a JavaScript “update.” Victims opened the script directly from Explorer’s compressed-folder view, leaving a temporary path containing the distinctive .zip.116\ fragment.
The script then launched a real legal-document decoy while quietly installing the malicious MSI in the background.
The MSI masquerades as a product named “Background Service” from “Apple Inc.” and installs a real copy of Exodus Wallet version 24.33.4 under %APPDATA%\ExdBackupTool\. At the time of Huntress’ analysis, the roughly 201 MB package had no detections on VirusTotal.
Its apparent legitimacy is central to the evasion strategy: the bundled wallet communicates with genuine Exodus services and retains almost all of the original application files.
Huntress Researchers said that, discovered infrastructure capable of redirecting victims through the search-ms: protocol into a WebDAV-hosted Explorer view, although no confirmed victims used that route.
Only three files in the wallet’s 1,973-file application bundle were modified. One patch prevents Electron windows from appearing by replacing the show(), focus() and center() methods, leaving the wallet running invisibly without a taskbar entry or user interface.
A second altered source file loads a 50 MB JavaScript component that acts as a manual PE loader, decrypting and memory-mapping a 10 MB Windows payload without writing it to disk.
The decrypted RAT contains six modules for remote command execution, file operations, script execution, SOCKS proxying, hidden VNC access, and browser theft.
The browser component targets Chrome, Edge and Firefox, collecting saved passwords, cookies, autofill information and extension data.
It also includes a cookie-wiping capability designed to force victims to reauthenticate, potentially giving operators another opportunity to capture valid sessions or credentials.
Instead of relying solely on attacker-controlled infrastructure, the malware uses Azure Table Storage as a command-and-control dead drop.
The RAT creates and polls table entries for tasking and results, blending malicious traffic into a legitimate Microsoft cloud service. This complicates network blocking and can delay disruption while defenders submit abuse reports.
Persistence is established through a scheduled task named ExdBackupTool, which relaunches the invisible Exodus.exe every hour.
Researchers also observed a related task, INetHealth, that repeatedly clears Windows proxy settings.
That behavior appears designed to bypass enterprise proxy inspection because the RAT retrieves the current user’s Internet Explorer proxy configuration before initiating communications.
Organizations should treat a detection as a full interactive compromise, not simply an infostealer incident.
Hidden VNC and SOCKS functionality may allow operators to access affected systems directly, move through internal networks and use compromised endpoints as relays.
Defenders should investigate for ExdBackupTool, ExodusHelper, an invisible Electron wallet process under %APPDATA%, scheduled task launches from svchost.exe, and suspicious JavaScript execution originating from browsers, download folders or ZIP staging paths.
Security teams should also inspect %TEMP% for MSI artifacts, as a coding error in the JavaScript dropper can prevent cleanup after installation.
Credential response must extend beyond password resets. Stolen session cookies may remain valid after a password change, so affected organizations should revoke active web sessions, rotate credentials, invalidate browser sessions and review identity-provider logs for token reuse.
Enabling Windows file-extension visibility, restricting Windows Script Host execution from user-writable paths, and turning off the WebClient service where WebDAV is unnecessary can reduce exposure to the campaign’s delivery mechanisms.
| Item | Description |
|---|---|
jn0101.msi SHA256: c513a7346484ee69a2931c4a89956ee50aa63e4366ef989315e669d8f10d7485 | Fake “Exodus Backup Tool” installer, 210,767,872 bytes, unsigned, 0/76 on VirusTotal |
SHA256: 8c3b41ea5a85778145a6e5772bfee2eb0f8b027d0af199fb71a76dfb8bb29e5a | Decrypted modular RAT payload, memory-resident only, not present on VirusTotal, nor uploadable. |
%APPDATA%\ExdBackupTool\ | Install directory. Genuine Exodus installs to %LOCALAPPDATA%\exodus |
app.asar | Trojanized Exodus 24.33.4 bundle, 281,876,194 bytes, 3 of 1,973 files modified |
debug.log | Attacker build artifact shipped by mistake, 1,830 bytes, references C:\123\exodusUpdater: |
%TEMP%\<guid>.tmp.node | koffi FFI module extracted from the asar at runtime, 2,340,864 bytes |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
A decade-old authentication bypass in OpenSSH on musl-based Linux lets attackers log into accounts that…
Bitdefender researchers have revealed a vulnerability called GhostMap that affects Android devices. This vulnerability can…
Microsoft has announced a vulnerability in Windows Paint that could let unauthenticated attackers execute malicious…
An autonomous penetration-testing framework linked to South Korean banking breaches and cloud supply-chain attacks is…
Shopify is making IP allowlisting mandatory for all public apps to limit abuse of stolen…
OpenAI has introduced GPT-6 Cyber, a security-focused model built to find and validate exploitable vulnerabilities…