Exodus, Organization 3 and Organization 2: Trojanized Exodus Wallet Installer Deploys RAT to Steal Browser Credentials and Cookies

Sophisticated Malware Campaign Abuses Trojanized Exodus Wallet Installer to Deploy Modular RAT

A stealthy malware campaign has exploited a trojanized installer for the legitimate Exodus cryptocurrency wallet to distribute a modular remote access trojan (RAT) designed for long-term interactive access rather than immediate cryptocurrency theft. Discovered by Huntress between late July and mid-August 2026, the campaign compromised four unrelated organizations, with three victims infected within 85 minutes on August 18 using an installer created just a day prior.

Attack Vectors and Execution

The intrusion begins with JavaScript-based lures disguised as either:

• A PDF document (with a .pdf.js double extension, appearing harmless when Windows hides file extensions).
• A software update contained in a ZIP archive.

In both cases, opening the file triggers Windows Script Host, displays a legitimate decoy document (hosted on trusted infrastructure), and silently installs a malicious MSI package via msiexec. A second observed method involved a ZIP file with a JavaScript "update," executed directly from Explorer’s compressed-folder view, leaving a temporary path with a .zip.116\ fragment.

Evasion and Payload Delivery

The MSI masquerades as "Background Service" from "Apple Inc." and installs a real copy of Exodus Wallet (v24.33.4) under %APPDATA%\ExdBackupTool\. At the time of analysis, the 201 MB package had zero detections on VirusTotal, leveraging the wallet’s legitimacy to evade detection. Only three of the wallet’s 1,973 files were modified:

• One patch prevents Electron windows from appearing, leaving the wallet running invisibly without a taskbar entry.
• Another loads a 50 MB JavaScript component that decrypts and memory-maps a 10 MB Windows RAT without writing it to disk.

RAT Capabilities and Command-and-Control

The decrypted RAT includes six modules for:

• Remote command execution
• File operations
• Script execution
• SOCKS proxying
• Hidden VNC access
• Browser data theft (Chrome, Edge, Firefox targeting passwords, cookies, autofill, and extensions)

Notably, the malware wipes cookies to force reauthentication, potentially enabling attackers to capture new sessions. Instead of traditional C2 infrastructure, it uses Azure Table Storage as a dead drop, blending malicious traffic with legitimate Microsoft cloud services to evade network blocking.

Persistence and Defense Evasion

Persistence is maintained via a scheduled task (ExdBackupTool) that relaunches the invisible Exodus.exe hourly. A related task (INetHealth) repeatedly clears Windows proxy settings, likely to bypass enterprise proxy inspection. The RAT retrieves the user’s Internet Explorer proxy configuration before initiating communications.

Impact and Indicators of Compromise (IOCs)

Organizations should treat detections as full interactive compromises, given the RAT’s ability to enable lateral movement, hidden VNC access, and SOCKS proxying. Key IOCs include:

• Installer: jn0101.msi (SHA256: c513a7346484ee69a2931c4a89956ee50aa63e4366ef989315e669d8f10d7485)
• Install directory: %APPDATA%\ExdBackupTool\
• Trojanized files: Modified app.asar (3 of 1,973 files altered)
• Scheduled tasks: ExdBackupTool, INetHealth
• Artifacts: %TEMP%\<guid>.tmp.node, debug.log (attacker build artifact)

The campaign’s rapid payload rebuilds and targeted delivery suggest an active, evolving operation rather than opportunistic malware reuse.

Source: https://gbhackers.com/trojanized-exodus-wallet-installer/

Exodus cybersecurity rating report: https://www.rankiteo.com/company/exodus-io

World Health Organization cybersecurity rating report: https://www.rankiteo.com/company/world-health-organization

"id": "EXOWOR1788326823",
"linkid": "exodus-io, world-health-organization",
"type": "Cyber Attack",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'type': 'Organization'},
                       {'type': 'Organization'},
                       {'type': 'Organization'},
                       {'type': 'Organization'}],
 'attack_vector': ['JavaScript-based lures (PDF document with .pdf.js '
                   'extension)',
                   'Software update in ZIP archive'],
 'data_breach': {'personally_identifiable_information': 'Yes (browser data, '
                                                        'session tokens)',
                 'sensitivity_of_data': 'High (personally identifiable '
                                        'information, authentication tokens)',
                 'type_of_data_compromised': 'Browser data (passwords, '
                                             'cookies, autofill, extensions), '
                                             'session data'},
 'date_detected': '2026-07-late to 2026-08-mid',
 'description': 'A stealthy malware campaign has exploited a trojanized '
                'installer for the legitimate Exodus cryptocurrency wallet to '
                'distribute a modular remote access trojan (RAT) designed for '
                'long-term interactive access rather than immediate '
                'cryptocurrency theft. The campaign compromised four unrelated '
                'organizations, with three victims infected within 85 minutes '
                'on August 18, 2026, using an installer created just a day '
                'prior.',
 'impact': {'data_compromised': 'Browser data (passwords, cookies, autofill, '
                                'extensions), potential session hijacking',
            'identity_theft_risk': 'High (browser data theft, session '
                                   'hijacking)',
            'operational_impact': 'Full interactive compromise, potential '
                                  'lateral movement, hidden VNC access, SOCKS '
                                  'proxying',
            'systems_affected': 'Windows systems with Exodus Wallet installer'},
 'initial_access_broker': {'backdoors_established': 'Modular RAT with hidden '
                                                    'VNC, SOCKS proxy, and '
                                                    'browser data theft',
                           'entry_point': 'Trojanized Exodus Wallet installer'},
 'investigation_status': 'Ongoing',
 'motivation': 'Long-term interactive access, lateral movement, data theft',
 'post_incident_analysis': {'root_causes': 'Use of trojanized legitimate '
                                           'software (Exodus Wallet) to evade '
                                           'detection, abuse of Azure Table '
                                           'Storage for C2, and rapid payload '
                                           'rebuilds for targeted delivery.'},
 'recommendations': 'Treat detections as full interactive compromises. Monitor '
                    'for IOCs such as the installer (jn0101.msi), modified '
                    'Exodus Wallet files, scheduled tasks (ExdBackupTool, '
                    'INetHealth), and artifacts like %TEMP%\\.tmp.node '
                    'and debug.log.',
 'references': [{'source': 'Huntress'}],
 'response': {'third_party_assistance': 'Huntress'},
 'title': 'Sophisticated Malware Campaign Abuses Trojanized Exodus Wallet '
          'Installer to Deploy Modular RAT',
 'type': 'Malware Campaign'}