CTI · corroborated · 2026-09-02

Malicious Exodus Installer Steals Browser Credentials and Turns PCs Into SOCKS Proxies

Full story & timeline

MITRE ATT&CK

• T1195 Supply Chain Compromise Initial Access
• T1204 User Execution Execution
• T1059 Command and Scripting Interpreter Execution
• T1055 Process Injection Stealth
• T1539 Steal Web Session Cookie Credential Access
• T1090 Proxy Command and Control

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Malicious Exodus Wallet Installer - MSI Execution via Msiexec
id: a7e3b1c4-92f6-4d8a-b5e1-3c7f9a2d8e4b
status: experimental
description: >
    Detects msiexec.exe executing MSI packages from paths associated with
    the trojanized Exodus cryptocurrency wallet installer (Huntress, 2026).
    The malicious installer modifies three files in the legitimate Exodus
    package while deploying a modular RAT with VNC, SOCKS proxy, and
    browser-data theft capabilities. Attackers used JavaScript files
    masquerading as PDFs (.pdf.js) to trigger msiexec silently.
references:
    - https://cyberpress.org
    - https://gbhackers.com
author: Tia N. List
date: 2026/09/02
tags:
    - attack.t1204
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_msiexec:
        Image|endswith: '\msiexec.exe'
    selection_flags:
        CommandLine|contains:
            - '/i '
            - '/quiet'
            - '/qn'
            - '/passive'
    selection_suspicious_path:
        CommandLine|contains:
            - '\Users\Public\'
            - '\ProgramData\'
            - '\AppData\Local\Temp\'
            - '\Downloads\'
    condition: selection_msiexec and selection_flags and selection_suspicious_path
falsepositives:
    - Legitimate software installations using msiexec from temp directories
level: medium

References

• https://cyberpress.org
• https://gbhackers.com