AmnesiaStealer: The macOS Malware That Watches You Browse in Real Time
A new macOS infostealer written in Rust has been quietly making the rounds, distributed via a fake GitHub page as part of so-called ClickFix attacks. Jamf researchers have named it AmnesiaStealer, and it's nastier than most.
The delivery mechanism is depressingly simple. Victims land on a convincing fake download page and are tricked into pasting a Terminal command. From there, a three-stage infection chain kicks off: a shell script fetches and runs the payload, the stealer hoovers up everything it can find, and a third module sits waiting for remote instructions to hijack the victim's browser entirely.
On paper, it resembles other macOS stealer families like Atomic (AMOS), MacSync, and CrashStealer. But Jamf flags three things that make it stand out: a builder-driven configuration system, logic that branches based on macOS version to exploit relevant bypasses, and a remote-control second stage that goes well beyond passive data theft.
Once running, the malware does a quick reconnaissance pass, then prompts the user for their login password and validates it locally. It then copies login and data-protection keychains, scrapes databases from Chromium-based browsers, and grabs Apple Notes and documents for good measure. Six browsers are in its crosshairs, including Chrome, Brave, Arc, and Edge.
There's a particularly unpleasant trick it pulls with browser credentials. AmnesiaStealer overwrites the per-browser Safe Storage key in the login keychain with one the attacker already controls. Any data encrypted after that point is readable on the operator's end. Anything saved before? Gone. The malware simply accepts that loss and moves on.
For Safari cookies and TCC database access, it reaches for CVE-2020-9771, an old bypass that only works on macOS 26 if Terminal or the malware process already holds Full Disk Access. It also attempts two separate TCC framework bypasses to gain broader permissions, then archives everything and ships it off to a C&C server before installing a LaunchDaemon for persistence.
The most alarming part is the stream module. Triggered by a remote_stream command from the operator, it clones the victim's browser profile and launches it headless using the Chrome DevTools Protocol. The attacker then gets a live screencast at around 3 frames per second and full interactive control: keyboard, mouse, scrolling, navigation, tab management, all translated into CDP calls in real time.
As Jamf puts it, this is a hands-on-keyboard hidden browser session, not an automated dump. The victim sees nothing. The attacker is effectively sitting in their browser.
That combination of passive data harvesting and active session hijacking in a single package is what makes AmnesiaStealer worth paying attention to, even by the grim standards of modern macOS malware.