Researchers at Jamf Threat Labs have identified AmnesiaStealer, a sophisticated multi-stage infostealer targeting macOS systems.
Beyond standard credential harvesting, it grants malicious actors real-time, invisible command over the user’s Chromium-based browsers by running a concealed headless instance. The campaign relies on ClickFix social engineering tactics, utilizing fraudulent GitHub repository pages that urge targets to execute a harmful shell script via the Terminal application.
The attack sequence begins on a deceptive clone of GitHub featuring a fake “Download for macOS” prompt that directs users to copy and paste a command into their terminal. This triggers the download and execution of the initial Rust-crafted payload, which acts across several vectors at once. It prompts the user with a counterfeit native macOS login dialog to harvest their account password, subsequently leveraging these credentials to decrypt and siphon data from the macOS Keychain, Apple Notes, browser data vaults, and local file storage.
Additionally, this primary stage targets Safari cookies by exploiting CVE-2020-9771, an older vulnerability patched by Apple long ago that nevertheless remains effective on systems running macOS Catalina. To maintain access, the malware installs a root-level LaunchDaemon disguised as Apple’s native crash reporting utility, helping it blend into active process lists. Gathered information is temporarily organized inside a randomly generated folder, compressed into an archive, and transmitted back to the command-and-control (C2) server.
What distinguishes AmnesiaStealer from standard macOS malware is its secondary stage. Upon receiving a “remote_stream” instruction from the C2 server, the initial payload deploys a second Rust executable that leverages the Chrome DevTools Protocol for live remote administration. This component initializes a background browser instance and sets up a WebSocket bridge to the attackers’ infrastructure, effectively converting the compromised Apple computer into a hidden, operator-controlled browser environment.
This streaming capability functions across seven different Chromium-based applications: Google Chrome, Brave, Microsoft Edge, Arc, Opera, Vivaldi, and vanilla Chromium. By duplicating the user’s browser profile (including all active authentication sessions) into the headless instance, the adversary gains complete interactive access. Operators can browse authenticated sessions, extract plaintext cookies via the DevTools Protocol, and manipulate financial services, email inboxes, or cryptocurrency platforms as if they had physical access to the device.
Furthermore, the software incorporates an evasion script that alters browser fingerprinting functions to keep anti-fraud detectors from recognizing the headless browser as automated software. The executable has a clipboard-manipulation component targeting ten distinct cryptocurrency networks built into it but remains turned off initially, indicating it is reserved for targeted strikes against high-value individuals.
Clues within the C2 server infrastructure offer insight into the threat actors’ origins. The authentication portal is labeled “Amnesia Panel,” and incorrect password entries trigger Russian-language error prompts, indicating Russian-speaking creators. Compilation artifacts left inside the binary expose the builder’s local user path as /Users/admin/.cargo/, alongside [HYBRID_DEBUG] debugging strings that were mistakenly included in the final release version. Finally, an embedded XOR decryption string “4mn3s1a_2o26!xK” indicates the malware was prepared for deployment throughout 2026.
Researchers note that AmnesiaStealer aims to extract user credentials, browser information, and active live sessions from Mac users, achieving these goals quite effectively. The combination of a functional data harvester and an operational browser-hijacking module is what makes this particular threat significant enough to monitor.
