Exodus wallet malware steals crypto passwords
Attackers are tricking people into installing a fake update or PDF that secretly installs a real copy of the Exodus crypto wallet alongside hidden spyware. The spyware steals saved passwords, cookies, and browser extension data, and gives the attacker ongoing remote access to the victim's machine.
- Report priority
- Medium
- Victim
- Exodus wallet
What is known
Victims open a JavaScript file disguised as a PDF or a software update, which quietly runs an installer that drops a real Exodus wallet app with three of its files secretly altered to hide a second, invisible program that steals data and lets an attacker connect in.
What to do
Check whether you or your organization opened a file with a double extension.pdf.js, or ran a JavaScript file from inside a ZIP claiming to be a software update, and look for a scheduled task named ExdBackupTool or INetHealth on Windows, or an Exodus install under %APPDATA%\ExdBackupTool\ that you did not knowingly set up.
Only install Exodus wallet from exodus.com directly, never from an emailed or downloaded PDF or ZIP. If you find the ExdBackupTool scheduled task or that folder, treat the machine as compromised, disconnect it, change passwords and reauthenticate accounts from a clean device, and report it to your security team.
Reported details
An attacker sends a victim a file named to look like a PDF or a ZIP containing what appears to be a software update. Opening it shows a real decoy document while a hidden installer sets up a genuine copy of Exodus wallet with three files quietly swapped. The altered files stop the wallet's window from ever appearing, then load a hidden program that reads saved browser passwords, cookies, and extension data and reports back to the attacker.
The loader chain uses a JavaScript file (often double-extensioned as.pdf.js) to invoke Windows Script Host, show a decoy document, and silently run an MSI masquerading as an Apple 'Background Service.' The MSI installs a genuine Exodus Wallet 24.33.4 build with three files patched: Electron's show, focus, and center methods are replaced so the app runs with no window, and a 50MB JS component acts as a manual PE loader that decrypts and memory-maps a 10MB RAT without touching disk. The RAT supports remote command execution, file operations, scripting, SOCKS proxying, hidden VNC, and Chrome/Edge/Firefox credential and cookie theft, and it also wipes cookies to force reauthentication.