Trojanized Exodus Wallet Installer Deploys RAT to Steal Browser Credentials and Cookies

Gbhackers •Mayura Kathir • September 2, 2026

A sophisticated malware campaign has abused a trojanized installer for the legitimate Exodus cryptocurrency wallet to deploy a modular remote access trojan (RAT) capable of stealing browser credentials, session cookies, and extension data. The campaign prioritizes long-term interactive access over direct cryptocurrency theft, combining hidden VNC, SOCKS proxying, file management and browser-data theft in an […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Trojanized Exodus Wallet Installer Deploys Remote Access Trojan Between late July and mid-August 2026, multiple organizations were compromised by a malware campaign using a tampered installer for the legitimate Exodus cryptocurrency wallet. Victims were tricked into downloading a JavaScript file that installed a genuine but modified version of Exodus 24.33.4, which could never be opened. The malware, a modular remote access trojan (RAT), was hidden within the installer and capable of remote command execution, browser credential theft, and creating a SOCKS proxy. Researchers identified four organizations affected, with three attacks occurring within an 85-minute window. The RAT communicates with Microsoft Azure Table Storage to avoid detection, and the installer registered zero detections on VirusTotal. The campaign is focused on long-term access rather than direct cryptocurrency theft. Current investigations are ongoing to assess the full scope of the impact. 4 sources 68

Extracted Entities

Trojanized Exodus Wallet Installer Deploys RAT to Steal Browser Credentials and Cookies

The full story

Extracted Entities

Attack Types (3)

MITRE ATT&CK (2)

Tools (1)