Three lines of JavaScript are all it takes to make an application disappear. Overwrite the Electron functions that show, focus and centre a window, and every window the program creates still gets built and wired up, then quietly dropped on the floor. Nothing in the taskbar. Nothing to alt-tab to. Nothing to close.
That trick sits inside a tampered installer for Exodus Wallet, analysed by Huntress. The installer really does put a working copy of Exodus 24.33.4 on the machine, talking to genuine Exodus infrastructure and generating exactly the traffic a real wallet generates. The victim just never sees it. What they also get is a modular remote access tool aimed at browser credentials rather than coins.
Four unrelated Huntress-protected organizations were compromised by the same tooling between late July and mid August 2026, three of them on August 18 within 85 minutes of each other, using an installer built the day before. At the time of analysis, none of the 76 engines on VirusTotal flagged it.
A PDF that was really a script
On three endpoints, someone opened what looked like a work document. The filename ended in .pdf.js, and because Windows hides known extensions by default, the user saw a PDF while Windows Script Host saw a script. On two of them the parent process was chrome.exe, so the file ran straight out of the browser as soon as the download finished. The script opens a genuine decoy document, in one case a real legal brief pulled live from law[.]georgetown[.]edu, while writing an installer to the temporary folder and running it silently.
One detail matters for responders. The script tries to delete that installer five seconds later using setTimeout, a function Windows Script Host does not have. The call throws, an empty catch block swallows the error, and the cleanup never happens, so the dropper is very likely still on disk.
Launched by Explorer so it looks like you did it
The installer is unsigned, roughly 201 MB against the genuine 190 MB, and its metadata is fiction: it names Apple Inc as manufacturer and calls itself Background Service. It launches the wallet through explorer.exe rather than directly, which drops the elevated installer token and re-parents the process to the shell, so in a process tree it looks exactly like something the user double-clicked. Everything lands in a per-user folder, so administrator rights are never requested. Of the 1,973 files inside the application archive, only three had been touched.
Fifty megabytes hiding seventeen kilobytes
The replaced key-storage file is 50 MB, of which one array accounts for all but about 17,000 bytes. The obfuscator splits every string into five-character chunks and rebuilds them at runtime, so grepping the bundle for the delivery address or the domain returns nothing at all. Underneath is a manual Portable Executable loader written in JavaScript, calling Windows APIs through koffi, a library genuine Exodus does not bundle. The array holds just over 10 million bytes at perfect entropy and exact 16-byte alignment, and the AES-256-CBC key that unlocks it is hardcoded in the same file. Decrypted, it is a 10 MB executable that never touches the disk.
It carries six plugin DLLs, all compiled inside a 199-second window on August 14: remote command execution, file transfer, browser credential and cookie theft, a SOCKS proxy, hidden VNC, and a script engine. Command and control runs over encrypted WebSockets, and a named mutex, ExodusHelper, stops a second copy starting.
What to hunt for
Look for the abandoned installer in the temporary folder, a per-user directory named ExdBackupTool, the ExodusHelper mutex, and the .zip.116 staging fragment Explorer leaves when a file is run from inside an archive. The delivery infrastructure sat at 35[.]212[.]159[.]20.
The analysis is published by Huntress, which credits Tanner Filip for contributions to the investigation. It belongs to the same family of modular tooling as Abyssos, and it makes the same point as last week's crypto stealer deobfuscation work: the target is not the wallet, it is the browser sitting next to it.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.