ModStealer malware hijacks browser extensions to drain crypto wallets

By BlockAI

Lead: ModStealer malware is a newly discovered, cross-platform threat targeting crypto users and developers. ModStealer malware steals browser extension data, wallet files, system credentials, and digital certificates to enable direct asset theft. Security teams found ModStealer malware active across Windows, Linux, and macOS, with infections linked to deceptive recruiter ads aimed at Node.js developers. ModStealer malware remained undetected for weeks, highlighting supply chain risk and tainted software tooling in crypto development.

Crypto wallet data theft

ModStealer malware specifically targets crypto wallet data theft by scraping browser extensions and local wallet files. The malware collects seed phrases, private keys, and API keys stored in browser extensions and exfiltrates them to remote C2 servers. ModStealer malware’s capability to capture browser extensions data raises risks for users who manage funds through extension wallets. Once wallet data is stolen, ModStealer malware can enable on-chain exploits and quick drains of funds. Protecting keys and limiting extension exposure reduces the chance ModStealer malware succeeds.

Node.js/npm security

Researchers found ModStealer malware was distributed via fake recruiter ads and compromised or malicious packages targeting Node.js environments. This vector ties ModStealer malware to broader concerns about Node.js/npm security and tainted software tooling. Developers who install packages from unverified sources may accidentally pull ModStealer malware into development machines. ModStealer malware’s presence in dev environments creates supply chain risk, because compromised tooling can propagate across teams. Strengthening package vetting and using isolated containers reduces the attack surface.

macOS persistence

On macOS, ModStealer malware achieves persistence by posing as a background helper and creating a hidden file named .sysupdater.dat. That persistence allows ModStealer malware to run at startup and remain hidden from casual inspection. The malware’s obfuscation and stealth techniques helped ModStealer malware bypass major antivirus engines for weeks. Monitoring startup items and unusual helper processes can reveal ModStealer malware activity. macOS persistence mechanisms make cleanup harder, so detection is critical.

How ModStealer works

ModStealer malware uses multiple tactics to gather data and avoid detection. It harvests browser extensions data, system credentials, and digital certificates then sends data to C2 exfiltration endpoints. The malware targets both user-level and developer-level artifacts, meaning ModStealer malware can convert compromised credentials into large-scale exploits. Researchers noted ModStealer malware uses obfuscation, multi-platform binaries, and social-engineered delivery. The coordinated design makes ModStealer malware a dangerous actor in the crypto threat landscape.

Defend against ModStealer

To defend against ModStealer malware, follow secure development and endpoint practices. Verify npm packages, use checksum and signature checks, and limit global installs to reduce ModStealer malware exposure. Enable robust endpoint detection and anomaly monitoring for wallet-related processes to spot C2 exfiltration traffic. On macOS, scan for unexpected helper apps and files like .sysupdater.dat to detect ModStealer malware persistence. Educate teams to avoid suspicious recruitment offers and downloads that could deliver ModStealer malware.

Why this matters now

ModStealer malware illustrates how supply chain risk and tainted software tooling threaten crypto assets. The malware’s cross-platform reach and focus on browser extensions data make it an immediate concern for traders, developers, and custodians. Because ModStealer malware bypassed many detections, the incident underscores gaps in current defenses. Acting quickly reduces the window for ModStealer malware to convert stolen credentials into stolen funds.

Sources to this article

Mosyle (2025) ModStealer malware discovery report. Available at: https://mosyle.com (Accessed 12 September 2025).

Ledger (2025) Industry advisory on tainted tooling and wallet risks. Available at: https://ledger.com (Accessed 12 September 2025).