New ‘ModStealer’ Malware Targets Browser Crypto Wallets, Evades Antivirus Detection

A new strain of malware engineered to steal cryptocurrency wallet data is slipping past all major antivirus engines, according to Apple security firm Mosyle.

Called ModStealer, the infostealer has been active for nearly a month without detection. Researchers report that the malware is being distributed through malicious recruiter ads aimed at developers and uses a heavily obfuscated NodeJS script to bypass traditional signature-based defenses.

Obfuscation scrambles the malware’s code and adds layers of tricks that render it unreadable to standard antivirus tools, which rely on recognizing familiar code patterns. This allows ModStealer to execute instructions on infected systems without triggering alerts.

Unlike most Mac-targeted malware, ModStealer is cross-platform, affecting Windows and Linux as well. Its primary objective is data exfiltration, with pre-loaded instructions designed to target 56 browser wallet extensions to extract private keys, credentials, and certificates. The malware also supports clipboard hijacking, screen capture, and remote code execution, giving attackers near-total control over compromised devices. On macOS, it achieves persistence through Apple’s LaunchAgent system.

Mosyle notes that ModStealer fits the “Malware-as-a-Service” model, where developers sell ready-made tools to affiliates with limited technical skills. The rise of this model has fueled a surge in infostealers this year, with Jamf reporting a 28% increase in 2025 alone.

The discovery follows recent npm-focused attacks, in which malicious packages like colortoolsv2 and mimelib2 leveraged Ethereum smart contracts to hide secondary malware stages. In these cases, attackers also relied on obfuscation and trusted developer infrastructure to evade detection.

ModStealer takes this threat further, demonstrating how cybercriminals are escalating tactics across ecosystems to compromise developer environments and directly target cryptocurrency wallets.