Malicious wallet mimics Exodus and silently installs RAT on Windows

Huntress detected activity across four unrelated organizations it protects from late July to mid-August 2026. In three cases, the breaches occurred within 85 minutes, indicating that the attackers were able to quickly reuse the same infrastructure.

How the malicious wallet is distributed

Victims received files that hid their true form. In one case, the file appeared as a PDF with a . .pdf.js, while in another a JavaScript file was hidden inside a ZIP. When the user opened the decoy file, a real document was displayed to avoid raising suspicion, while in the background the modified application was silently installed.

According to Huntress, the attackers used the genuine Exodus 24.33.4 application as a cover. The malicious MSI installs almost the entire legitimate wallet, but modifies only three of its 1.973 files. The package details falsely display the name “Background Service” and the publisher “Apple Inc.”

The installer was unsigned and, when analyzed by Huntress, was not detected by any of the 76 VirusTotal engines. One of the modified files prevents the wallet window from being displayed, focused, or moved. A second one acts as a loader and decrypts a 10 MB Windows payload in memory. This makes it appear that an Exodus process is running on the computer, but without displaying the normal application environment.

READ ALSO Windows users at risk from alleged programs that block security updates

RAT capabilities

The malicious payload is modular and includes functions to:

• remote command execution,
• browsing and transferring files,
• stealing passwords and cookies from browsers,
• SOCKS proxy function,
• hidden control via VNC,
• script execution.

The combination of these capabilities can be used to hijack accounts, track the user, and further move within a corporate network. Huntress also found that the malware used Azure Table Storage to exchange commands and results, rather than relying solely on a conventional command-and-control server. The sample also supports WebSockets and contains dozens of additional hosts that mimic legitimate ones, but did not communicate with the malware during testing.

Persistence and proxy bypass

The modified application is saved in the user's AppData folder and launched via explorer.exe, so that the activity looks more like a normal program opening. The scheduled task is then created ExdBackupTool, which restarts the Exodus.exe every hour.

A second work, entitled INetHealth, deletes the settings ProxyEnable, ProxyServer and AutoConfigURL and refreshes Windows internet settings. This way, malware traffic can bypass the corporate proxy and gain direct access to the control infrastructure.

Huntress recommends that organizations treat an affected computer as an actively compromised device, not as a simple malware incident. The device should be isolated, other user profiles checked, and both the malicious folder and scheduled tasks removed.

Saved passwords, browser cookies, and active sessions should be considered exposed. Session tokens can remain active even after a password change. For this reason, sessions should be revoked and login credentials changed from a clean device. Huntress also recommends displaying full file extensions in Windows and avoiding JavaScript files disguised as documents.

Security teams can look for instances where Windows Script Host is launched from download folders, Electron apps with no visible window, and programs running from AppData via explorer.exeDisabling the WebClient service, where WebDAV is not needed, can also limit the specific delivery path via search-ms:.

Indicative indicators of violation

The indicators also include modules Dll4_fileman.dll, Dll4_socks.dll, Dll4_cmd.dll, Dll4_script.dll, Dll4_browser.dll and Dll4_vnc.dll. Researchers warn that rapid isolation is especially important, as the attackers may have already gained interactive access and stolen session data. Indicators should be combined with behavioral checks, because installers can be recreated and have a different hash.