Loading story…
A campaign targeting four unrelated organizations used a trojanized Exodus Wallet 24.33.4 installer to deploy a modular, memory-resident remote-access trojan (RAT). Victims received disguised JavaScript lures—including fake .pdf.js files and ZIP-contained scripts—that displayed legitimate decoy PDFs while silently installing an unsigned MSI. The altered wallet suppressed its Electron application windows, operated from a per-user AppData directory, and reflectively loaded an encrypted RAT payload.
The RAT enabled remote command execution, browser-credential theft, hidden VNC access, SOCKS proxying, file management, and script execution. It used Azure Table Storage as an observed dead-drop command-and-control channel and established persistence through scheduled tasks; an earlier intrusion also repeatedly cleared user proxy settings, apparently to bypass corporate proxy controls. Affected endpoints should be treated as fully interactively compromised, requiring credential resets and session-cookie remediation alongside malware removal and persistence hunting.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
On August 18, 2026, three observed organizations were compromised within 85 minutes using the installer built the previous day. The trojanized wallet suppressed Electron windows, reflectively loaded a modular RAT, and established hourly scheduled-task persistence as ExdBackupTool.
An unsigned MSI impersonating Exodus Wallet 24.33.4 was built on August 17, 2026, with false Apple/Background Service metadata and installation under %APPDATA%\ExdBackupTool\. Its encrypted 10 MB PE32+ RAT payload was compiled six minutes before the installer.
From late July through mid-August 2026, Huntress observed the same malicious tooling compromise four unrelated organizations. Victims opened disguised JavaScript files, including .pdf.js lures and JavaScript in ZIP archives, which displayed decoy PDFs while silently installing a tampered Exodus Wallet installer.
Additional indicators were disclosed for the Exodus/ExodusHelper malware, including hashes, the jn0101.msi installer, 35[.]212[.]159[.]20, us05[.]org, Azure Table Storage endpoints, and numerous suspected C2-related domains. The malware's Dll4 modules indicate file-management, SOCKS proxy, command execution, scripting, browser-interaction, and VNC remote-control capabilities.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 55 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
itsecurityguru.org
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcehuntress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple active malware campaigns are delivering **remote access trojans (RATs)** using deceptive lures and multi-stage execution chains designed to evade endpoint defenses. Malwarebytes reported a campaign dubbed **DEAD#VAX** that distributes a file masquerading as a “PDF” but actually delivered as a **virtual hard disk (`.vhd`)** hosted via **IPFS**; when opened, Windows mounts the VHD and the victim is tricked into launching a **Windows Script File (`.wsf`)** that ultimately deploys **AsyncRAT**. The chain includes anti-analysis checks and **process injection** into Microsoft-signed binaries such as `RuntimeBroker.exe`, `OneDrive.exe`, `taskhostw.exe`, and `sihost.exe`, enabling hands-on-keyboard remote control while minimizing obvious on-disk artifacts. Separately, reporting described **DesckVB RAT v2.9**, a modular **.NET** RAT using an obfuscated **WSH JavaScript** stager followed by **PowerShell**-based anti-analysis checks and an in-memory (“fileless”) loader, emphasizing persistence and a plugin-based architecture for post-compromise capabilities. Another campaign distributes **ValleyRAT** disguised as a legitimate *LINE* installer, targeting **Chinese-speaking users**; it attempts to weaken defenses by using PowerShell to add broad **Windows Defender exclusions**, performs sandbox checks (e.g., mutex/file-locking behaviors), and uses advanced injection (reported as **PoolParty Variant 7** via Windows I/O completion ports) to hide within trusted processes while stealing credentials and maintaining C2 communications.
Jun 29, 2026
Researchers reported an active malware supply-chain campaign distributing trojanized Windows installers that abuse DLL sideloading to launch **STX RAT** in memory through a malicious `CRYPTBASE.dll`. Confirmed lures included fake packages for **CPU-Z**, **X-VPN**, **Binance**, **MEXC**, **Bybit**, **Exodus**, **MetaTrader 5**, and a Steam-themed decoy, with infrastructure tied to `supp0v3[.]com` and an actor tracked as **Leda Elacoate**. In the X-VPN case, investigators said the vendor's official channels were not compromised; only users who downloaded the repackaged installer from attacker-controlled sources were exposed. X-VPN later released Windows version **77.5.3** with hardening changes after disclosure of the DLL search-order weakness. Incident analysis of the CPU-Z lure showed the intrusion extending well beyond initial access. After STX RAT execution, the operator deployed **PureLogs Stealer** for credential theft and **PureHVNC** via `InstallUtil.exe`, then staged prolonged data theft using **rclone** tunneled through a hidden **QEMU Alpine** virtual machine acting as a proxy. The observed operation lasted about five days and included roughly **54 hours** of continuous exfiltration to `94.156.119[.]71:443`, illustrating a coordinated crimeware workflow that combined fake software distribution, remote access, credential harvesting, and covert exfiltration.
Jul 12, 2026
Attackers ran a large-scale cryptocurrency theft campaign built around **ElectroRAT**, a custom Golang remote access trojan hidden inside trojanized apps branded as **Jamm**, **eTrade**, and **DaoPoker**. The malware was distributed through dedicated websites, fake company fronts, forum accounts, social media personas, and paid promotion, targeting users on **Windows, Linux, and macOS**. Researchers said the operation had been active since at least January 2020 and likely reached thousands of victims, based in part on roughly **6,500 unique visitors** to Pastebin pages used to retrieve command-and-control details. Once installed, ElectroRAT ran covertly in the background as **`mdworker`** and gave operators broad surveillance and theft capabilities, including keylogging, screenshot capture, file upload and download, and remote command execution. The campaign’s infrastructure also showed ties to **Amadey** and the **KPOT** stealer, suggesting overlap with established criminal tooling, while the custom malware itself reportedly evaded antivirus detection for nearly a year. The operation highlights how convincing crypto-themed brands and cross-platform Electron applications were used to lure investors into installing malware that enabled wallet compromise and broader system access.
Aug 15, 2026