Trojanized Exodus Wallet Installer Deploys Remote Access Trojan

Between late July and mid-August 2026, multiple organizations were compromised by a malware campaign using a tampered installer for the legitimate Exodus cryptocurrency wallet. Victims were tricked into downloading a JavaScript file that installed a genuine but modified version of Exodus 24.33.4, which could never be opened. The malware, a modular remote access trojan (RAT), was hidden within the installer and capable of remote command execution, browser credential theft, and creating a SOCKS proxy. Researchers identified four organizations affected, with three attacks occurring within an 85-minute window. The RAT communicates with Microsoft Azure Table Storage to avoid detection, and the installer registered zero detections on VirusTotal. The campaign is focused on long-term access rather than direct cryptocurrency theft. Current investigations are ongoing to assess the full scope of the impact.

Key Points: • Malware campaign disguises a RAT within a legitimate Exodus wallet installer. • Four organizations were compromised, with three attacks occurring in a short time frame. • The RAT employs Azure Table Storage for communication to evade detection.