Hackers Hide a Full Remote Access Trojan Inside a Real Exodus Crypto Wallet

Cybersecuritynews •Tushar Subhra Dutta • September 2, 2026

Cybercriminals have been caught using a tampered installer for the Exodus cryptocurrency wallet to plant a full remote access trojan. The program looks close enough to the real wallet, but it is designed so its window never appears. The campaign reached victims through disguised files. One route used a fake PDF ending in .pdf.js, while […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Trojanized Exodus Wallet Installer Deploys Remote Access Trojan Between late July and mid-August 2026, multiple organizations were compromised by a malware campaign using a tampered installer for the legitimate Exodus cryptocurrency wallet. Victims were tricked into downloading a JavaScript file that installed a genuine but modified version of Exodus 24.33.4, which could never be opened. The malware, a modular remote access trojan (RAT), was hidden within the installer and capable of remote command execution, browser credential theft, and creating a SOCKS proxy. Researchers identified four organizations affected, with three attacks occurring within an 85-minute window. The RAT communicates with Microsoft Azure Table Storage to avoid detection, and the installer registered zero detections on VirusTotal. The campaign is focused on long-term access rather than direct cryptocurrency theft. Current investigations are ongoing to assess the full scope of the impact. 4 sources 68

Hackers Hide a Full Remote Access Trojan Inside a Real Exodus Crypto Wallet

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (2)