# Trojanized signed app via update channel

Signed installer or app loading a modified dependency, repackaged binary, or bloated bundle from the official update path

_Area: Software supply chain and CI/CD. Seen in 3 disclosed reports; latest 2026-09-01. Updated 2026-11-02._

## How it works
Users trust a vendor's signed installer and update channel, so they assume everything it delivers is the vendor's code. That assumption breaks when an attacker repackages the distribution: the outer binary stays genuine and signed, but a dependency, a bundled script, or a repackaged APK/DLL inside it is swapped for malicious code. The signature only vouches for the wrapper, not for every file it loads. In one case a genuine wallet bundle shipped with three modified files, one suppressing all UI and another carrying an encrypted reflective loader [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-exodus-crypto-wallet-installer-rat.md). In another, a signed desktop app loaded a backdoored `ffmpeg.dll` that pulled in an anomalous `d3dcompiler_47.dll` holding an encrypted payload [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-3cx-voip-software-compromise-supply-chain-threats.md). Elsewhere, legitimate game APKs and a `mono.dll` update library were repackaged with downloader/backdoor code [E2](https://bugbountylibrary.com/r/blog%3Awelivesecurity-com-en-eset-research-rigged-game-scarcruft-compromises-gaming-platform-supply-chain-attack.md).

## Where it shows up
- Signed installer whose bundled files differ in hash or size from the official build [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-exodus-crypto-wallet-installer-rat.md)[E2](https://bugbountylibrary.com/r/blog%3Awelivesecurity-com-en-eset-research-rigged-game-scarcruft-compromises-gaming-platform-supply-chain-attack.md)
- Anomalous sibling DLLs next to expected ones (e.g. `d3dcompiler_47.dll` beside `ffmpeg.dll`) [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-3cx-voip-software-compromise-supply-chain-threats.md)
- Modified manifest entry points or patched libraries in APKs/DLLs [E2](https://bugbountylibrary.com/r/blog%3Awelivesecurity-com-en-eset-research-rigged-game-scarcruft-compromises-gaming-platform-supply-chain-attack.md)
- Bundles bloated with hex-arithmetic string-array obfuscation; size anomalies (50MB helper vs 16MB UI) [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-exodus-crypto-wallet-installer-rat.md)
- Magic-byte markers and embedded RC4 keys in a loaded DLL [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-3cx-voip-software-compromise-supply-chain-threats.md)
- UI suppression overrides (`show`/`focus`/`center`) in Electron code [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-exodus-crypto-wallet-installer-rat.md)

## How to review
The invariant: every file the signed wrapper loads must match the vendor's published build, and the signature must cover the code that actually executes. Check that loaded dependencies are hash-pinned and signed, that no unexpected sibling libraries sit in the install directory, and that bundle contents match a known-good manifest. For mobile, confirm manifest entry points and library hashes match the legitimate release.

## How finders spotted it
- Correlated four unrelated orgs hit by identical tooling within 85 minutes, then pattern-matched 1,973 asar files for obfuscated JS to isolate three modified files [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-exodus-crypto-wallet-installer-rat.md)
- Noticed a size anomaly (50MB key helper vs 16MB UI bundle) confirming the tampering [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-exodus-crypto-wallet-installer-rat.md)
- Spotted a suspicious APK on VirusTotal, traced it to the official vendor site, found the same APK served there, then found a second trojanized game and a malicious `mono.dll` via telemetry [E2](https://bugbountylibrary.com/r/blog%3Awelivesecurity-com-en-eset-research-rigged-game-scarcruft-compromises-gaming-platform-supply-chain-attack.md)
- EDR flagged the legitimate signed binary; reverse-engineered it, traced `ffmpeg.dll` to `d3dcompiler_47.dll`, spotted the `FE ED FA CE` marker and RC4 key, then decrypted the payload [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-3cx-voip-software-compromise-supply-chain-threats.md)

## Variants seen
- Electron app with UI-suppressed genuine bundle plus memory-only modular RAT [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-exodus-crypto-wallet-installer-rat.md)
- Repackaged Android APKs and a patched Windows update DLL [E2](https://bugbountylibrary.com/r/blog%3Awelivesecurity-com-en-eset-research-rigged-game-scarcruft-compromises-gaming-platform-supply-chain-attack.md)
- Signed desktop app loading a backdoored dependency DLL with encrypted shellcode [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-3cx-voip-software-compromise-supply-chain-threats.md)

## Impact and severity
High: signed, trusted distribution reached many users. One chain stole session cookies surviving password resets, turned hosts into SOCKS relays, and ran hidden VNC [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-exodus-crypto-wallet-installer-rat.md); another reached 600k+ customers with a 7-day sleep and GitHub-hosted C2 [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-3cx-voip-software-compromise-supply-chain-threats.md); a third delivered espionage backdoors to a targeted community [E2](https://bugbountylibrary.com/r/blog%3Awelivesecurity-com-en-eset-research-rigged-game-scarcruft-compromises-gaming-platform-supply-chain-attack.md). Impact rose from legitimate signing, wide reach, and layered RAT modules.

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **Exodus Wallet** (app.asar bundle (exodus_patch.js, keystorage.js)) 24.33.4: The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT. Report: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-exodus-crypto-wallet-installer-rat.md
- **3CX DesktopApp** (ffmpeg.dll) 18.12.407 and 18.12.416 for Windows and 18.11.1213, 18.12.40: 3CX VoIP Software Compromise & Supply Chain Threats. Report: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-3cx-voip-software-compromise-supply-chain-threats.md

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-exodus-crypto-wallet-installer-rat.md
- E2: https://bugbountylibrary.com/r/blog%3Awelivesecurity-com-en-eset-research-rigged-game-scarcruft-compromises-gaming-platform-supply-chain-attack.md
- E3: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-3cx-voip-software-compromise-supply-chain-threats.md