AmnesiaStealer targets macOS Chromium sessions with live remote control
Jamf Threat Labs has disclosed AmnesiaStealer, a Rust-based information stealer aimed at macOS that can hijack authenticated Chromium browser sessions and give an operator hidden interactive control. The multi-stage malware is delivered through a counterfeit GitHub download page labelled “Download for macOS”, which claims to come from a verified publisher.
The lure uses the ClickFix technique: users are told to copy and paste a Base64-encoded command into Terminal. That command retrieves a password-protected ZIP archive from remote infrastructure, deploys a dropper and removes the script from the host. The archive contains a first-stage Mach-O Rust binary with an encrypted, build-time configurable payload.
Credential theft and broad local collection
The first-stage stealer collects data from the Keychain, browsers, Apple Notes and Telegram, while also performing host reconnaissance and geolocation profiling. Its configuration can specify command-and-control endpoints and enable a cryptocurrency clipboard-hijacking module for assets including Bitcoin, Ethereum, TRON, Monero, Solana and Cosmos.
AmnesiaStealer displays a native installer-style prompt to obtain the macOS password, then validates the value through dscl. When validation fails, it repeatedly displays an “Incorrect password” dialog. Jamf said the captured password may be supplied to sudo -S, used with security unlock-keychain -p, and stored in clear text both in the staging directory and as ~/.pwd.
An AppleScript component mutes system audio and collects Apple Notes, Telegram sessions, iCloud Keychain material and selected files from Desktop, Documents and Downloads. It also targets 16 Chromium-family browsers, including Google Chrome, Brave, Arc and Microsoft Edge, gathering profile artefacts such as cookies, login data, history, bookmarks, preferences and extension directories.
Browser takeover changes the risk profile
The malware can recover Chrome master keys by reading the Chrome Safe Storage password from Keychain. It also attempts to steal Safari cookies, using CVE-2020-9771 against Catalina systems; Jamf noted that the technique works on macOS 26 only with Full Disk Access, which this malware does not have. Collected material is staged beneath /tmp in a randomly named directory, archived and exfiltrated. A root LaunchDaemon impersonating Apple’s crash reporting service provides persistence.
A command named remote_stream triggers download of a second Rust binary. This module supports Chrome, Brave, Microsoft Edge, Arc, Opera, Vivaldi and Chromium, launches a browser in headless mode and uses Chrome DevTools Protocol through a WebSocket relay. Operators can send keystrokes, click, scroll, navigate and manage tabs while receiving a live screencast at roughly 3fps.
The module injects a script to patch browser fingerprinting APIs, seeking to reduce automation detection by visited sites. This differs from a conventional cookie dump because attackers can operate inside the victim’s authenticated browser session. The combination of macOS social engineering and credential theft also fits the wider pattern of macOS living-off-the-land activity and SIM-farm threatsmacOS living-off-the-land activity and SIM-farm threats, where user interaction can initiate the compromise.
Business implication
For businesses managing Macs, the practical response is to train staff not to execute pasted Terminal commands from download pages, monitor unexpected browser processes and LaunchDaemons, and investigate prompts requesting system passwords outside established software-installation workflows.