Reported by 2 outlets
Malicious Exodus Installer Steals Browser Credentials and Turns PCs Into SOCKS Proxies
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.57 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Malicious Exodus Installer Steals Browser Credentials and Turns PCs Into SOCKS Proxies
cyberpress.org · 41d ago · September 2nd, 2026
A malicious installer disguised as the Exodus cryptocurrency wallet is being used to deploy a modular remote-access trojan (RAT) that steals browser data, enables hidden remote control, and converts infected Windows computers into SOCKS proxy relays . Researchers observed four unrelated organizations compromised between late July and mid-August 2026. Three incidents occurred within 85 minutes on August 18, using an installer created only one day earlier. The campaign delivers a genuine copy of Exodus Wallet version 24.33.4, but secretly modifies three files in the application package. Although the wallet runs in the background and communicates with legitimate Exodus services, victims never see its interface. The malware prevents the Electron application from displaying windows, focusing, or appearing in the taskbar. This makes the wallet look like it never launched while the hidden payload continues running. Exodus Installer Hijacks PCs One delivery method uses JavaScript files disguised as PDFs with names ending in .pdf.js . Because Windows commonly hides known file extensions, victims may only see what appears to be a normal PDF document. When opened, the JavaScript displays a legitimate decoy PDF from trusted websites or content-delivery networks. At the same time, it silently downloads and installs a malicious MSI package using msiexec . How an unopenable crypto wallet ends up installing a modular RAT to steal browser credentials (Source: huntress) A second method uses ZI
-
update from gbhackers.com
Trojanized Exodus Wallet Installer Deploys RAT to Steal Browser Credentials and Cookies
gbhackers.com · 42d ago · September 2nd, 2026
A sophisticated malware campaign has abused a trojanized installer for the legitimate Exodus cryptocurrency wallet to deploy a modular remote access trojan (RAT) capable of stealing browser credentials, session cookies, and extension data. The campaign prioritizes long-term interactive access over direct cryptocurrency theft, combining hidden VNC, SOCKS proxying, file management and browser-data theft in an […] The post Trojanized Exodus Wallet Installer Deploys RAT to Steal Browser Credentials and Cookies appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .