Fake Exodus wallet installs spyware on Macs

Published August 28, 2026

A fake version of the Exodus cryptocurrency wallet for Macs secretly installs spyware that steals passwords, takes screenshots, and lets attackers control your computer. The malware hides inside a fake PDF or ZIP file that looks real.

Report priority
Medium
Involves
macOS

What is known

Attackers send a fake Exodus wallet installer disguised as a PDF or ZIP file, which silently installs spyware when opened.

What to do

Check if you downloaded a fake Exodus wallet installer named something like 'Exodus_24.the latest version' or 'wallet_update.pdf.js' between late July and mid-August 2026.

Delete the fake file immediately and scan your Mac with a trusted antivirus tool like Malwarebytes or XDR. Update your Exodus wallet through the normal update channel only.

Reported details

You download what looks like a legitimate Exodus wallet update from a shady website. The file is actually a fake PDF or ZIP that tricks your Mac into running a hidden installer. The real wallet window never appears, but the spyware does. It steals your browser passwords, takes screenshots, and lets attackers move files or turn your Mac into a hidden relay for other attacks.

A malicious installer for the Exodus cryptocurrency wallet (version 24.33.4) was repurposed to silently deploy a remote access trojan (RAT) on macOS systems. The fake installer mimics the legitimate application but omits its user interface, instead embedding a 10 MB Windows payload loader in three of its 1,973 bundled files. The trojan, undetected by 76 VirusTotal engines, steals browser credentials, cookies, and session data, executes arbitrary commands, and provides full remote control, including proxy access and file exfiltration.

Huntress researchers observed the campaign targeting four unrelated organizations between late July and mid-August 2026, with three breaches occurring within 85 minutes. The installer's metadata falsely labels it as a "Background Service" from "Apple Inc." and uses a.pdf.js decoy file or a hidden JavaScript ZIP archive to distribute the payload.

References

View Original Source