Huntress identified tampered Exodus cryptocurrency wallet installers on four unrelated customer networks between late July and mid-August 2026. The package installs a genuine copy of Exodus Wallet 24.33.4, takes deliberate steps to make sure the application never displays a window, and runs a modular remote access trojan in the background that targets browser credentials rather than coins. Original reporting for this article comes from Huntress.

Three of the four organizations were compromised on August 18, within 85 minutes of each other, using an installer compiled the day before. The MSI carrying it was 210,767,872 bytes, unsigned, and carried false metadata listing Apple Inc as the manufacturer and "Background Service" as the product name.

At the time of Huntress's analysis, the installer was detected by 0 of 76 engines on VirusTotal.

The July detection initially looked like ClickFix, and it is worth knowing why. ClickFix is a social engineering pattern where a fake verification or update page instructs the visitor to paste a command into Windows or open a file they just downloaded, so the person completes the risky step themselves and browser download warnings get clicked past by the victim. The tell in that case was conhost.exe --headless powershell -e followed by a Base64 blob, a command shape that shows up in ClickFix cases but is also a normal Windows developer function.

What Huntress actually observed were two delivery paths. One was a fake PDF named with a .pdf.js double extension, opened straight out of chrome.exe after download, since Windows hides known extensions by default. The other was an archive named Update_GS_7G0N-254V38L2350.zip holding a single JavaScript file, opened from Explorer's compressed folder view without extracting it first.

If your staff open documents delivered through a browser, that is the exposure here. Two victims believed they were opening work material, a marketing ebook and a legal brief, and both documents were real and hosted on domains they had no reason to question. The wallet was the disguise, and nobody in those offices was ever meant to open it.

From Lure to Loader: The Infection Chain and MSI Payloads

The infection starts with a file the user believes is a document. On three endpoints, a JavaScript file named to end in .pdf.js arrived through the browser, and because Windows hides known extensions by default, the victim saw a PDF. Both instances show chrome.exe as the parent process, meaning the file was launched straight from the download shelf and handed to Windows Script Host (MITRE T1204.002 and T1059.007).

The script does two things at once. It opens a genuine decoy document so the victim gets what they expected, one a marketing ebook served from Storyblok and another a real legal brief pulled live from law[.]georgetown[.]edu, while in the background it writes an MSI to %TEMP% and runs msiexec /i "%TEMP%\jn0101.msi" /quiet /norestart. Every document the user actually saw was hosted on a domain with a clean reputation.

A second delivery route swapped the double extension for an archive, Update_GS_7G0N-254V38L2350.zip, holding a single ordinary .js file. The user ran it from Explorer's compressed folder view without extracting, which leaves a distinctive staging path containing a .zip.116\ fragment under %LOCALAPPDATA%\Temp\. That chain installed jg0384.msi. A third route was found on the delivery infrastructure but never used against a victim: us05[.]org returned an HTTP 302 to a search-ms: URI with an @8080 suffix, mounting an attacker-controlled WebDAV share inside a window that looks like local search results.

The MSI itself is a thin wrapper. Built with WiX Toolset 6.0 and unsigned, it carries no Registry table, no Service table, and no Scheduled Task table. It drops six files into %APPDATA%\ExdBackupTool\ and fires exactly one custom action, LaunchExodus: [WindowsFolder]explorer.exe "[INSTALLDIR]Exodus.exe". Launching through the shell drops the elevated msiexec token and re-parents the wallet under explorer.exe, so in a process tree it reads as a user double-click. The per-user install path also means no administrator prompt ever appears.

Three of the 1,973 files inside app.asar were altered. keystorage.js holds an AES-256-CBC blob of 10,021,392 bytes at an entropy of 8.000, decrypted with a key and IV hardcoded in the same file, and mapped into memory using koffi to call VirtualAlloc, WriteProcessMemory, RtlAddFunctionTable, and CreateThread. That is a reflective PE loader written in JavaScript (T1620), so the payload never touches disk and never reaches VirusTotal.

Decrypted, it is a 10 MB PE32+ whose .rdata section stores six plugin DLLs, each exporting its own name: remote command execution, a file manager with HTTP upload and download, a browser stealer covering Chrome, Edge, and Firefox passwords, cookies, and autofill, a SOCKS proxy, hidden VNC that builds a second invisible desktop against a copy of the victim's browser profile, and a LuaJIT script engine supporting injection, registry operations, DPAPI, and raw sockets. The source shows no clipboard or seed-phrase theft capability. Hidden VNC plus SOCKS means an operator can work interactively on the host and use it to reach the rest of your network.

Command and control runs over WebSockets via WinHTTP with bcrypt encryption, but the observed channel was an Azure Table Storage dead drop at lgapistorage123.table.core.windows.net, table ftable434, where T_ rows carry tasking and R_ rows carry results keyed by bot ID. Forty-five backup hosts using api., cdn., and auth. prefixes sit in the config block unused. Persistence comes from an ExdBackupTool task registered through the Task Scheduler COM API, relaunching the wallet hourly from svchost.exe, alongside an INetHealth task that blanks ProxyEnable, ProxyServer, and AutoConfigURL to force beacon traffic around the corporate proxy.

• jn0101.msi SHA256 c513a7346484ee69a2931c4a89956ee50aa63e4366ef989315e669d8f10d7485
• jg0384.msi and Update_GS_7G0N-254V38L2350.zip (second delivery chain)
• Decrypted RAT payload SHA256 8c3b41ea5a85778145a6e5772bfee2eb0f8b027d0af199fb71a76dfb8bb29e5a
• dll4_browser.dll 7e74f6e2eb7a17a8d25bb322a14c392c9d92c6ab29fc66b50221da134a1bdba8, dll4_vnc.dll 5fe753945da0eaac2c2ef3845cba603dea6c3e8529fa581d7e0192f8af60391a, dll4_socks.dll 2f47cfbb13f7a8a2d30d287f4ddd974fabea6762ad9781d438eb53da41b4582d
• Delivery host 35.212.159[.]20 and us05[.]org, WebDAV share \\us05.org@8080\update
• Mutex ExodusHelper, MSI ProductCode {4046AD2B-3831-4011-AEAD-D98C5C9FD1EF}

What a Compromised Wallet Endpoint Costs the Business

The most expensive fact in this campaign is that the six modules stored in the payload's .rdata section do not describe a coin stealer. They describe a general-purpose remote access toolkit that happens to arrive dressed as a wallet, and a single infected laptop gives an operator the same reach a hired contractor would have with your user's login.

Hidden VNC, a SOCKS proxy, and a browser stealer in the same package is not a crypto-theft toolkit. It is full interactive access with a pivot.

What that buys the operator on your endpoint breaks down cleanly:

• dll4_vnc.dll creates a second invisible Windows desktop and relaunches Chrome or Edge there against a copy of the user's profile, so the attacker browses as your employee while they work unaware on the visible desktop.
• dll4_browser.dll takes passwords, cookies, autofill data, and extension data from Chrome, Edge, and Firefox, and includes a cookie wiper that forces a fresh login the attacker can capture.
• dll4_socks.dll turns the host into a relay, so traffic to third parties leaves from your corporate address space.
• dll4_script.dll runs a LuaJIT engine in-process with registry access, DPAPI, raw sockets, and token queries, which means new capability arrives without a new file on disk.

The cookie theft is where a wallet infection turns into an identity incident. A stolen session cookie carries your user past SSO and past MFA, so an account stays reachable after the password changes. If that laptop holds live sessions to your VPN portal, your email tenant, your payroll platform, or your banking portal, the attacker inherits every one of them at the permission level your user already holds.

Your egress logs will be thinner than you expect. The hourly maintenance task blanks ProxyEnable, ProxyServer, and AutoConfigURL under the user's Internet Settings key, which pushes the command and control WebSocket traffic around your corporate proxy and out through a direct connection. Anything your proxy would normally have recorded, inspected, or blocked simply never reached it, and rebuilding what left the host becomes a memory and endpoint exercise instead of a log query.

Tasking and results move through Azure Table Storage at table.core.windows.net, a Microsoft domain that sits on no blocklist and appears in ordinary business traffic. There is no attacker-owned server in the path, so the channel stays up while an abuse report works its way through Microsoft, and your network telemetry gives you little to pivot on during scoping.

Budget for a longer investigation than a normal malware cleanup. The RAT never touches disk, the persistence task was registered through the Task Scheduler COM API so no command line records its creation, and every artifact is per-user, meaning a shared workstation has to be examined profile by profile. That is forensic labor, not a reimage decision.

Disclosure follows from what the browser module touched. If saved credentials or session data reached client portals, payment systems, or health or financial records, you are working to contractual notification clauses and regulatory timelines based on presumed exposure, because you cannot prove which stored items were read.

Treasury teams, finance staff, and crypto-adjacent firms carry additional exposure here. Outbound cryptocurrency transfers do not reverse, and an operator sitting inside a live browser session on a finance workstation can move funds using approvals your systems already granted. When the money involved belongs to clients, the recovery conversation includes them.

Detection Opportunities Across Endpoint and Network Telemetry

The most reliable endpoint signal in this campaign is an hourly process launch you can time. Telemetry from one August case shows svchost.exe starting C:\Users\<user>\AppData\Roaming\ExdBackupTool\Exodus.exe at 42 minutes past every hour, with Task Scheduler as the parent. Most hours record it twice, likely a second instance dying against the ExodusHelper mutex.

The task was registered through the Task Scheduler COM API instead of schtasks.exe, so there is no process creation event to catch (MITRE T1053.005). Hunting has to work from Task Scheduler operational event logs and the task XML on disk, since command-line hunting alone returns nothing. For a SOC running command-line-heavy detection logic, this is the difference between an alert and a silent hourly relaunch.

Process lineage gives a second angle. An Electron binary running out of a per-user directory, parented to explorer.exe, with no visible window is unusual on its own, and the payload spawns cmd.exe /c chcp 65001 >nul 2>&1 & systeminfo from inside that wallet process for host recon (T1082). A cryptocurrency wallet enumerating system inventory through a UTF-8 console is worth a ticket every time.

File and registry artifacts worth querying across the estate:

• %TEMP%\<guid>.tmp.node, the koffi FFI module extracted at runtime
• Leftover installers in %TEMP% using a two-letter, four-digit naming scheme, left behind because the dropper's cleanup call throws and fails silently
• The Uninstall key entry with ProductCode {4046AD2B-3831-4011-AEAD-D98C5C9FD1EF} and the reversed UpgradeCode under HKLM\SOFTWARE\Classes\Installer\UpgradeCodes
• C:\Windows\Installer\SourceHash{4046AD2B-3831-4011-AEAD-D98C5C9FD1EF}, which survives deletion of the install directory
• Repeated writes to ProxyEnable, ProxyServer, and AutoConfigURL under HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings (T1112)

Those proxy writes pair with conhost.exe --headless powershell -e plus a Base64 blob under a task named INetHealth. Recurring proxy-clearing activity on a schedule tells you the operator has already had egress inspected or blocked on that host and built maintenance to undo it, which pushes the incident timeline back well before the alert fired.

On the delivery side, look for msiexec running with /i "%TEMP%\...msi" /quiet /norestart where the parent is Windows Script Host (T1218.007). Explorer's compressed-folder view leaves its own fingerprint: a staged execution path under %LOCALAPPDATA%\Temp\ containing a .zip.116\ fragment tells you a script ran from inside an archive that was never extracted. WebClient service starts and SMB or WebDAV connections to \\us05.org@8080\update or to 35.212.159[.]20 cover the search-ms: route, which nobody in the observed intrusions took.

Proxy logs are where the command and control shows. The observed channel is Azure Table Storage: POST, PUT, GET, and DELETE against lgapistorage123.table.core.windows.net and winapi.table.core.windows.net, table name ftable434, with the bot ID as PartitionKey and RowKeys prefixed T_ and R_. Also flag WinHTTP WebSocket upgrades from processes that have no business holding a persistent socket. Traffic to genuine Exodus infrastructure continues alongside all of this, so clean wallet netflow does not clear a host.

The 45 configured hosts using api., cdn., static., app., and auth. prefixes on small-business domains were never contacted during detonation and belong in a hunt list as leads, not blocklist entries. Hash indicators age out quickly here, with related builds such as ton435.msi and two files named setup1.msi all sitting at zero detections.

Immediate Containment and Hardening Steps

Pull the network cable on any host where that MSI ran before you start collecting evidence. An operator with interactive access and a proxy module can watch you work, and containment matters more than a clean forensic timeline here. Isolate the endpoint at the switch or through your EDR's network quarantine, and keep the machine powered on so the in-memory payload and its mutex state remain available for triage.

Treat every credential and key that touched that profile as taken. Any wallet seed phrase, private key, or exchange session used on that machine should be considered exposed, so generate a new wallet on a device you know is clean and move funds before you do anything else. For corporate accounts, rotate passwords and revoke active sessions and OAuth tokens, because a stolen session cookie keeps working after a password reset.

Cleaning the user profile tells you nothing about the other profiles on a shared machine. Every artifact in this campaign is per-user.

Cleanup has to cover more than the files. Delete the ExdBackupTool scheduled task as well as the install directory, since removing only the folder leaves an hourly task pointing at a path that no longer exists. Then check for leftovers the installer registers elsewhere:

• The dropper MSI is very likely still in %TEMP%, because the JavaScript cleanup call was written against a function Windows Script Host does not have and silently failed.
• C:\Windows\Installer\SourceHash{4046AD2B-3831-4011-AEAD-D98C5C9FD1EF} survives deletion of the install directory.
• The product's Uninstall key entry and the reversed UpgradeCode GUID under HKLM\SOFTWARE\Classes\Installer\UpgradeCodes.
• HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings, where ProxyEnable, ProxyServer, and AutoConfigURL were blanked. Confirm group policy has pushed your proxy configuration back after removal.

Block 35.212.159[.]20 and us05[.]org at the perimeter. The Azure Table Storage channel needs a different approach, since table.core.windows.net is a legitimate Microsoft endpoint that sits on nobody's blocklist. File an abuse report with Microsoft for the storage account and, where your business does not use Azure Storage directly, restrict outbound access to that service and alert on table API calls from workstations. The 45 prefixed small-business hostnames in the config are leads for hunting, and some of those domain owners are likely victims themselves.

For hardening, four changes cut off what you have seen here. Turn on file extension visibility in Explorer through group policy so a .pdf.js name reads as what it is. Block or alert on Windows Script Host execution from user download and temp folders. Disable the WebClient service on any endpoint that does not need WebDAV, which stops Explorer from mounting a remote share behind a search results window. Add AppLocker or WDAC rules that prevent msiexec from installing packages located in user-writable directories, and require administrative approval for MSI installation.

Longer term, keep treasury and crypto operations on a dedicated hardened workstation or a hardware wallet workflow that never shares a browser profile with day-to-day email. Tune your EDR to alert when an installer spawns a scripting engine, and when an application installs to %APPDATA% and starts by way of explorer.exe. In environments Capstone manages, Adlumin watches authentication behavior for sign-ins that do not match the user's normal pattern, which is how a reused session cookie surfaces after the endpoint is already clean.

Key Takeaway for Organizations Handling Crypto Assets

Every delivery path in this campaign ends the same way: a person you employ double-clicks something and Windows does exactly what it was designed to do. No exploit, no unpatched appliance, no stolen VPN credential. That is why this style of intrusion, whether it arrives as a fake document or as a pasted command, is difficult to stop with a blocklist. The victim is the one executing the code, and the execution itself looks legitimate at every layer of your telemetry.

Hash-based blocking ages out quickly here. The same builder has produced ton435.msi at 211,038,208 bytes, two separate files named setup1.msi at roughly 200 MB each, and another unnamed 210,894,848-byte package, all at zero detections. Your indicator list expires the next time the operator runs their build script, while the structural habits behind those files stay constant.

The action that matters most is controlling MSI execution from user-writable paths. If an installer can run out of a temporary folder under a standard user's own token, the delivery method becomes irrelevant, because whatever reaches your user's hands will install cleanly. Restricting that one behavior removes the step every chain in this campaign depends on.

The second point is scoping. If this installer ran on a machine, treat that host as fully compromised rather than as a malware cleanup. Any wallet seed phrase, private key, exchange session, or browser-stored credential that touched that profile should be considered in the operator's hands, and any crypto asset reachable from those keys should be moved to a wallet generated on a clean system.