digital asset

A newly identified strain of malware called ModStealer can bypass antivirus protections to steal data from cryptocurrency wallets on Windows, Linux, and macOS. It operated undetected for nearly a month, infiltrating systems through misleading job advertisements targeting software developers. ModStealer has multi-platform support and a stealthy execution chain, allowing it to launch simultaneous attacks across various operating systems. Upon execution, it scans for browser-based cryptocurrency wallet extensions, system credentials, and digital certificates. On macOS, it disguises itself as a background helper program to ensure continuous operation. Indicators of potential ModStealer infections include a hidden file named “.sysupdater.dat,” outbound connections to suspicious servers, unexpected background processes, unusual behavior from wallet extensions, and unauthorized access attempts to digital certificates. The malware poses significant risks to individual users by compromising private keys and seed phrases, and it could lead to large-scale thefts in the cryptocurrency industry. To protect against ModStealer, users are advised to use hardware wallets, enable multi-factor authentication, update antivirus software, avoid suspicious job ads, monitor startup processes, back up seed phrases offline, and use separate devices for transactions.