New ModStealer Evades Antivirus, Targets macOS Users to Steal Sensitive Data

A new macOS-focused threat, dubbed ModStealer, has emerged and is said to bypass traditional antivirus solutions while targeting developers and cryptocurrency holders, according to Mosyle. The cross‑platform malware is described as capable of compromising macOS, Windows and Linux systems, with its exact mechanisms for this versatility still unclear.

It was first identified by Mosyle and reported through 9to5Mac on 11 September 2024, having appeared on VirusTotal about a month earlier, indicating a period of stealth.

Technical findings suggest ModStealer uses persistence via Apple’s launchctl, embedding itself as a LaunchAgent to survive reboots, and it hides its payload under innocuous names such as “sysupdater.dat.” The malware is said to harvest data from more than 50 browser extensions, including cryptocurrency wallet extensions across Chrome and Safari, and to exfiltrate sensitive information via clipboard monitoring, screenshots and other browser data.

Mitigations emphasise validating recruiters, using disposable VMs, separating wallet workspaces and enabling multi‑factor authentication to reduce risk for developers and cryptocurrency users.