TL;DR \u2013 ReversingLabs has recognized a malicious npm bundle, \u201cpdf-to-office,\u201d that targets Atomic and Exodus crypto pockets customers by silently patching native software program to hijack transactions. The malware swaps recipient pockets addresses and stays persistent even after removing.<\/strong><\/p>\n Cybersecurity agency ReversingLabs (RL) has uncovered a brand new tactic risk actors are using to focus on cryptocurrency customers. Their newest analysis, shared with Hackread.com, reveals that cybercriminals are leveraging the npm<\/strong><\/a> (Node Bundle Supervisor) community to inject malicious code into domestically put in cryptocurrency pockets software program, particularly focusing on Atomic Pockets and Exodus. <\/p>\n This assault includes the malicious patching of authentic software program information, permitting attackers to intercept cryptocurrency transfers by silently swapping recipient pockets addresses.<\/p>\n RL researchers found a malicious npm bundle named \u201cpdf-to-office\u201d that falsely appeared as a utility for changing PDF information to Microsoft Workplace paperwork<\/a><\/strong>. Nevertheless, upon execution, it deployed a malicious payload to change key information inside Atomic Pockets and Exodus set up directories.<\/p>\n The malware overwrites authentic information with trojanised variations, secretly altering the vacation spot handle for outgoing cryptocurrency transactions. This permits attackers to stay undetected for an prolonged interval, because the pockets\u2019s core performance seems unchanged to the consumer.<\/p>\n ReversingLabs\u2019 automated Spectra Guarantee platform flagged this bundle as suspicious as a result of it exhibited behaviours in keeping with earlier npm-based malware campaigns. An obfuscated Javascript file was additionally discovered throughout the bundle, revealing malicious intent.<\/p>\n The payload focused the \u201cAtomic Wallets weren\u2019t the one goal of this malicious bundle, both. RL additionally detected a malicious payload that attempted to inject a trojanised file inside a authentic, locally-installed Exodus pockets as properly,\u201d wrote ReversingLabs\u2019 Software program Risk Researcher Lucija Valenti\u0107 in a weblog submit<\/a><\/strong>.<\/p>\n The attackers focused particular Atomic Pockets variations (2.91.5 and a couple of.90.6), indicating sophistication of their focusing on. The malicious information have been named accordingly, overwriting the proper file whatever the put in model.<\/p>\n \u201cWe additionally noticed what seems to be an effort by the malicious actors to cowl their tracks and thwart incident response efforts, or just to exfiltrate much more data,\u201d the researcher defined.<\/p>\n A very problematic a part of this marketing campaign is its persistence. Analysis signifies that even when the malicious \u201c Furthermore, the trojanised information inside Atomic Pockets and Exodus proceed to function, silently redirecting funds to the attackers\u2019 Web3 pockets. The one efficient method to eradicate the risk is an entire removing and re-installation of the affected pockets software program.<\/p>\nPretend Bundle and Malicious Injection<\/strong><\/h3>\n
![\"\"](\"https:\/\/hackread.com\/wp-content\/uploads\/2025\/04\/New-Crypto-Wallet-Hijacking-Campaign-Targeting-Atomic-and-Exodus-Users-1-1024x387.png\")
<\/a>\"atomic\/sources\/app.asar\"<\/code> archive in Atomic Pockets<\/strong><\/a>\u2018s listing and the \"src\/app\/ui\/index.js\"<\/code> file in Exodus<\/strong>.<\/a><\/p>\nPersistence and Influence<\/strong><\/h3>\n
pdf-to-office<\/code>\u201d bundle is faraway from the sufferer\u2019s system, the compromised cryptocurrency pockets software program stays contaminated.<\/p>\n