Cybersecurity researchers have uncovered a sophisticated attack in which a legitimate Exodus cryptocurrency wallet installer was manipulated to deliver a full Remote Access Trojan (RAT). The malicious package mimics the authentic Exodus installer closely, yet alters its behavior so the wallet interface never appears.
How the Trojan Works
The attack uses installer files with subtle tricks to hide its true nature. One distribution method involved a file named with a false extension like “.pdf.js”, another hidden inside a ZIP archive. Both lure victims with a genuine-looking document while silently installing the altered Exodus wallet version.
The modified MSI installer includes almost all of the legitimate Exodus 24.33.4 wallet’s bundled files—only three files out of nearly two thousand are changed. Its metadata is manipulated to display a fake publisher name and product details. When evaluated with 76 antivirus engines, the installer went undetected. Crucially, one altered script ensures that the application window never displays, while another loader component decrypts a 10 MB payload into memory. Users still see a process named “Exodus” running, but no visible window, hiding the RAT in plain sight.
Capabilities, Persistence, and Indicators
This RAT is modular. Its components include tools to steal browser credentials and cookies, host a SOCKS proxy, run hidden remote desktop sessions via VNC, execute scripts, browse and move files, plus issue remote commands. Attack commands and data exfiltration use sources like Azure Table Storage, plus WebSockets, and multiple configured command-and-control hosts—even if many were inactive in observed cases.
For persistence, the installer drops malicious files into the user’s AppData folder and schedules two Windows tasks. One task relaunches the malicious “Exodus.exe” hourly under the guise of a backup tool; the other clears proxy settings and resets internet configuration to maintain direct communication with the attacker-controlled servers.
Recent Incidents & Detection Advice
The campaign was active between late July and mid-August 2026 across four separate organizations already protected. In one case, three separate compromises occurred within 85 minutes—showing attackers can quickly re-use the exploit chain. Once breached, attackers are likely to have full interactive access to the machine.
Indicators of compromise (IoCs) include specific installer filenames (like jn0101.msi), false product metadata, modules with names like Dll4_browser.dll or Dll4_vnc.dll, and scheduled tasks such as INetHealth and ExdBackupTool. Also watch for processes running without visible windows from AppData and unauthorized script execution.
Recommended Defenses
When a system is compromised, it should be treated as a full-blown breach: isolate the host, examine all profiles, remove malicious directories and scheduled tasks. Assume that saved passwords, cookies, and session tokens are exposed. Reset passwords from clean systems and invalidate active sessions.
Preventive measures include displaying file extensions, avoiding double extensions like “.js” or downloads that look like PDFs, and monitoring for Electron-based apps launched without visible windows. Alerts should be in place for Windows Script Host execution from download folders, and for processes launched from AppData through explorer.exe. Disabling the WebClient service (if WebDAV is not needed) helps block certain delivery vectors.
This attack reveals how threat actors are becoming more adept at blending with trusted software. Simply copying a reputable crypto wallet installer and altering a few files gives them deep access without raising typical alarms. As cybersecurity defense shifts toward endpoint monitoring and behavior-based detection, this event underscores why trusting verified sources is no longer enough—watching what runs, where, and how is equally critical.
