A recent investigation has uncovered a sophisticated malware campaign that exploits a trojanized installer for the legitimate Exodus cryptocurrency wallet. This campaign deploys a modular remote access trojan (RAT) that has the potential to steal sensitive browser credentials, session cookies, and extension data. Rather than directly targeting cryptocurrency for theft, the malware prioritizes long-term interactive access to compromised systems. It ingeniously combines hidden VNC (Virtual Network Computing), SOCKS proxying, file management, and browser data theft in a notably stealthy manner.
Between late July and mid-August 2026, cybersecurity firm Huntress identified multiple compromises across four unrelated organizations that had some form of protection in place. Particularly alarming was an incident involving three victims on August 18, where they were compromised within a mere 85 minutes. This rapid sequence of attacks utilized an installer that had been created merely a day prior, underscoring the campaign’s aggressive and active operation style instead of relying on older malware kits.
The intrusive process is initiated with a JavaScript lure that masquerades as either a benign PDF document or a software update contained within a ZIP archive. In one known method, victims inadvertently download files with a .pdf.js double extension, which, due to Windows’ default behavior of hiding known file extensions, appear harmless. When the victim opens the file, it triggers the Windows Script Host, displays a decoy document that appears legitimate, and silently installs a malicious MSI package using msiexec.
Another observed method involved ZIP files that contained a JavaScript “update.” Victims directly opened the script from Explorer’s compressed-folder view, inadvertently leaving a temporary path that contained the distinctive .zip.116 fragment. Similar to the previous method, this script launched a deceptive legal document while simultaneously installing the malicious MSI in the background.
The malicious MSI pretended to be a product titled “Background Service” from “Apple Inc.” and installed a legitimate copy of Exodus Wallet version 24.33.4 at the path %APPDATA%\ExdBackupTool\. Intriguingly, at the time of Huntress’ analysis, this roughly 201 MB package had received no detections on VirusTotal, adding to the complexity of identifying the malware.
The illusion of legitimacy plays a central role in the malware’s evasion strategy. The bundled wallet interacts with genuine Exodus services and retains nearly all original application files, cleverly concealing its true nature. Huntress researchers even uncovered infrastructure capable of redirecting victims through the search-ms: protocol into a WebDAV-hosted Explorer view, although no confirmed instances of this route have been reported.
Only three of the nearly 2,000 files in the wallet’s application bundle were modified. One alteration prevents Electron windows from appearing by replacing essential methods, which allows the wallet to run invisibly without a taskbar entry or user interface. Another modified file loads a substantial JavaScript component that functions as a manual PE loader, decrypting and memory-mapping a 10 MB Windows payload without ever writing it to disk.
The decrypted RAT comprises six distinct modules that facilitate remote command execution, file operations, script execution, SOCKS proxying, hidden VNC access, and browser data theft. Targeting popular browsers like Chrome, Edge, and Firefox, the malware is able to collect saved passwords, cookies, autofill information, and extension data. A particularly concerning feature of the RAT is its ability to wipe cookies, essentially forcing victims to reauthenticate and providing operators with further opportunities to capture valid sessions or credentials.
In a clever twist, the malware does not solely rely on traditional attacker-controlled infrastructure. Instead, it utilizes Azure Table Storage as a command-and-control dead drop, blending malicious activities with legitimate Microsoft cloud services. This tactic complicates detection and can delay intervention efforts, especially as defenders navigate the process of submitting abuse reports.
To establish persistence, the RAT creates a scheduled task named ExdBackupTool that relaunches the hidden Exodus.exe every hour. Researchers have also observed a related scheduled task called INetHealth, which clears Windows proxy settings repeatedly. This behavior appears designed to bypass enterprise proxy inspections, as the RAT retrieves the current user’s Internet Explorer proxy configuration before initiating any communications.
Organizations finding themselves detecting this malware should treat the incident as a full compromise instead of merely an infostealer incident. The functionalities of hidden VNC and SOCKS proxying could enable operators to directly access affected systems, traverse internal networks, and use compromised endpoints to relay information.
Defensive teams are urged to investigate for indicators related to ExdBackupTool, ExodusHelper, and the invisible Electron wallet process residing under %APPDATA%. They should also conduct thorough examinations of scheduled task launches and suspicious JavaScript execution originating from browsers, download folders, or ZIP staging paths.
Beyond resetting passwords, organizations must actively revoke active web sessions, rotate credentials, and invalidate browser sessions to mitigate the repercussions of stolen session cookies, which may still be valid despite password changes. Strategies such as enabling Windows file-extension visibility, restricting Windows Script Host execution from user-writable paths, and disabling the WebClient service where WebDAV is unnecessary can further reduce exposure to this cunning campaign.
In summary, this malware campaign serves as a stark reminder of the continually evolving landscape of cyber threats, necessitating robust security measures and vigilance from organizations.