Mosyle uncovers new cross-platform malware undetected by antivirus tools

Mosyle has uncovered ModStealer, a cross-platform infostealer that has gone undetected by all major antivirus engines since first appearing on VirusTotal nearly a month ago, according to details shared exclusively with 9to5Mac. Mosyle says the malware is delivered through fake job recruiter ads targeting developers and uses a heavily obfuscated NodeJS JavaScript file that evades signature-based defenses, putting Windows and Linux systems at risk as well as macOS. Its main goal is data theft, including cryptocurrency wallets, credentials and certificates, with code targeting 56 browser wallet extensions. On Macs, it persists by abusing launchctl as a LaunchAgent, and Mosyle believes it fits the Malware-as-a-Service model.