Security researchers at Huntress have discovered a malware campaign that tricks victims into installing a real, fully functional copy of Exodus, a popular cryptocurrency wallet application, only to disable it so it can never actually be opened, using it instead as cover for a hidden spying tool.
The firm said it identified four separate organisations compromised between late July and mid-August 2026, three of them within an 85-minute window on a single day, using a version of the malware built the day before it was deployed.
According to Huntress, victims were lured into opening what appeared to be a work document or a routine software update. In practice, the files silently downloaded a Windows installer that presented itself, falsely, as an Apple “Background Service.” The installer placed a genuine, largely unmodified copy of the Exodus wallet, version 24.33.4, onto the victim’s machine. Of nearly 2,000 files bundled with the wallet, researchers found that only three had been altered.
One of those changes prevented the wallet from ever displaying a window, meaning it never appeared in the taskbar and could not be closed or interacted with by the user. The other two altered files formed a loader that decrypted and ran a separate 10-megabyte payload directly in the computer’s memory, without ever writing it to disk.
That hidden payload, researchers said, is a modular remote access trojan (RAT) with six separate capabilities: remote command execution, file browsing and transfer, a hidden virtual network connection (VNC) allowing an attacker to view and interact with the victim’s desktop unseen, a SOCKS proxy that could turn the infected computer into a relay for further attacks, a scripting engine, and a module built to steal saved passwords, cookies, and browser data from Chrome, Edge, and Firefox.
Despite the crypto wallet disguise, Huntress said the malware does not target wallet data, seed phrases, or cryptocurrency funds directly. Researchers instead described the campaign as being built for broad, hands-on remote access and credential theft, with the wallet acting purely as camouflage.
Because most of the installed software is genuine, unaltered Exodus code communicating with real Exodus servers, the tampered installer registered zero detections across 76 antivirus engines on VirusTotal at the time of testing, according to Huntress.
The malware also avoided using attacker-owned servers to communicate. Instead, researchers found it checking in with Microsoft’s Azure Table Storage service, a technique that allowed its network traffic to blend in with ordinary, legitimate cloud activity rather than triggering alerts tied to suspicious domains.
To maintain access, the malware created a scheduled task that silently relaunched the invisible wallet every hour. Huntress also identified a second, earlier-observed task that repeatedly reset a victim’s corporate proxy settings, a mechanism apparently built specifically to keep the malware’s outbound traffic from being blocked or inspected by network security controls.
Huntress said the operation shows signs of a single toolchain behind both the delivery mechanism and the trojanised wallet, including a shared code-obfuscation technique and an npm software package impersonating Intel. Researchers recommended that any organisation identifying these artefacts treat the affected host as a full interactive compromise, revoke active browser sessions, and rotate credentials rather than only resetting passwords.
Huntress’s full technical writeup, including indicators of compromise, is available at: The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT
