IronWorm Exodus Wallet Hook Listener Detection

Ethan Andrews@eandrews

•updated Jun 4, 2026•3•0•12

Detects network connections to the specific local port 8738 used by the IronWorm Exodus wallet injection module to exfiltrate stolen seed phrases and passwords. This rule specifically looks for outbound connections from the 'exodus.exe' process to localhost on port 8738.