Cybersecurity experts have identified a new threat involving the deployment of a remote access trojan (RAT) through a manipulated installation of the Exodus cryptocurrency wallet. The deceptive setup mimics the legitimate wallet but prevents users from seeing its interface, thus hiding its malicious intent.
How the Attack Was Executed
The attackers distributed the harmful software using disguised files, notably a fake PDF file ending in .pdf.js and a JavaScript file embedded in a ZIP archive. When opened, these files displayed a decoy document while the malicious wallet was installed in the background.
Huntress researchers detected this activity in four distinct organizations between late July and mid-August 2026. The speed of the attacks was notable, with three breaches occurring within a mere 85 minutes, highlighting the rapid execution capabilities of the perpetrators.
Potential Risks and Consequences
The threat posed by this trojan extends beyond the theft of cryptocurrency. The malicious payload is capable of extracting browser passwords and cookies, executing commands, transferring files, and providing remote desktop access. This multifaceted approach can lead to account takeovers, surveillance, and deeper incursions into the victim’s network.
The attackers employed a genuine Exodus 24.33.4 application as a front, similar to past incidents where malware was hidden within seemingly trustworthy desktop programs. This technique effectively obscures the malicious nature of the software.
Technical Details and Indicators
The altered installer almost completely replicates the original wallet, modifying only three out of 1,973 files. These changes include a script that prevents any wallet window from appearing. Additionally, the trojan uses Azure Table Storage for tasking, bypassing traditional attacker servers.
The malicious application is installed in the user’s AppData directory and launched using explorer.exe, creating a semblance of normal user activity. To maintain persistence, it schedules tasks that ensure the wallet runs hourly, and clears proxy settings to ensure unimpeded communication with command and control servers.
Recommended Protective Measures
Organizations are advised to treat any device compromised by this attack as fully breached. Immediate actions should include isolating the infected machine, reviewing user profiles, and removing any associated malicious directories and tasks. Browser cookies, saved passwords, and active sessions should be considered compromised.
To prevent such incidents, users should enable visibility for file extensions and avoid executing JavaScript files disguised as documents. Security teams should set alerts for suspicious script executions and monitor for software running from unusual directories like AppData. Disabling unnecessary services like WebClient can also reduce exposure to similar threats.
Rapid identification and containment are crucial, as attackers can quickly adapt their methods, altering file hashes and rebuilding installers to evade detection.
