Cross-OS Malware ‘ModStealer’ Threatens Crypto Wallets

Written by Aaron S.,

Editor-In-Chief

Last Updated: September 12, 2025

Key Takeaways

ModStealer, a cross-OS malware, steals crypto wallet data, credentials, and files while staying hidden from antivirus detection;
The malware targets over 50 browser wallet extensions, records clipboards, takes screenshots, and executes remote commands;
Mosyle warns ModStealer may be sold as Malware-as-a-Service; behavior-based security is vital as signature defenses fall short.

Ace quick missions & earn crypto rewards while gaining real-world Web3 skills. Participate Now! 🔥

BITDEGREE IN YOUR SOCIAL FEED

A new malware called ModStealer is spreading across macOS, Windows, and Linux, according to a report by 9to5Mac on September 11.

Researchers from the security company Mosyle found that the malware had been uploaded to VirusTotal but had gone unnoticed by antivirus tools for almost a month.

The malware is written in JavaScript using NodeJS and conceals its code to evade detection.

Candlesticks, Trendlines & Patterns Easily Explained (Animated Examples)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

Once installed, ModStealer runs in the background. It collects information such as wallet keys, certificates, account files, and browser extensions linked to crypto wallets.

Mosyle’s team identified code targeting more than 50 wallet extensions, including those on Safari and Chromium-based browsers.

The malware also records clipboard content, takes screenshots, and can run commands from a remote server. These features give attackers access to private information and control over infected systems.

On macOS, ModStealer exploits Apple’s launchctl tool to run as a LaunchAgent. This allows the malware to remain active even after a reboot. The stolen data is sent to a server that appears to be based in Finland but is connected to infrastructure in Germany.

Mosyle stated that ModStealer may be part of a Malware-as-a-Service model. In such setups, developers create the malware and sell it to affiliates, who then launch attacks without requiring deep technical skills.

Mosyle warned that antivirus tools that rely only on signatures are not enough to stop such threats. They recommend constant monitoring, behavior-based security systems, and more awareness of new attack methods.

Lucija Valentić at ReversingLabs recently reported that hackers have discovered a new method for spreading malicious software by using Ethereum ETH $4,591.15 smart contracts. How? Read the full story.