T1056.001

Input Capture: Keylogging

discovered 2026-05-26

Injects JavaScript into the Exodus desktop wallet to capture the wallet password and BIP-39 seed mnemonic as the user enters them, POSTed to the local listener on 127.0.0.1:8738.

View on MITRE ATT&CK

Seen in packages

Campaigns