T1056.001
Input Capture: Keylogging
discovered 2026-05-26Injects JavaScript into the Exodus desktop wallet to capture the wallet password and BIP-39 seed mnemonic as the user enters them, POSTed to the local listener on 127.0.0.1:8738.
View on MITRE ATT&CK