Kiran 
A newly documented macOS infostealer is skipping the usual “steal and dump” playbook in favor of something far more dangerous: taking the wheel of a victim’s own browser while the session is still logged in.
Dubbed AmnesiaStealer, the Rust-based malware was identified by researchers at Jamf and PolySwarm, and it distinguishes itself from the crowded field of Mac stealers by giving attackers hidden, real-time control over Chromium browsers rather than just harvesting credentials for later use.
AmnesiaStealer spreads via a ClickFix-style social engineering campaign centered on a counterfeit GitHub download page, complete with a fake “Verified Publisher” badge and GitHub’s familiar dark theme. Instead of delivering a file, the page instructs visitors to paste and run a Terminal command.
AmnesiaStealer Hijacks macOS Browsers Live
That command triggers a Base64-encoded first-stage script that silently downloads, signs, and launches the primary Rust payload, then deletes its own installer artifacts to reduce forensic traces.
Once active, the malware profiles the host, throws up a native-looking Installer password prompt, and uses the harvested credentials to unlock the user’s login keychain.
From there, it collects browser data, Apple Notes, Telegram session files, wallet-related browser artifacts, and documents, staging everything for exfiltration before establishing persistence via a LaunchDaemon disguised as an Apple crash-reporting component. The malware’s most notable capability sits in its second stage.
Rather than treating stolen browser databases as the end goal, AmnesiaStealer can retrieve a dedicated streaming module that clones the victim’s Chromium profile cookies, login data, local storage, and session storage into a hidden directory, then launches the victim’s actual browser executable in headless mode with remote debugging enabled.
This preserves the still-authenticated session while running invisibly in the background. Two WebSocket channels are then opened: one to the operator’s relay server, and one to the local Chrome DevTools Protocol endpoint.
Through CDP, operators can navigate sites, control mouse and keyboard input, manage tabs, view a live screencast at roughly 3 frames per second, and export or import cookies in plaintext.
Jamf reports this technique now covers seven Chromium-family browsers for live control, while sixteen browsers are targeted for Stage 1 data theft, reportedly the first documented instance of profile-cloning-based session hijacking on macOS.
“What makes AmnesiaStealer genuinely unsettling isn’t the data it steals it’s the fact that the browser itself becomes a puppet the operator can drive from inside your own machine, using your own trust tokens, while your antivirus sees nothing more alarming than a browser process,” said a threat researcher tracking the campaign.
AmnesiaStealer also carries forward legacy TCC bypass techniques and version-branched execution logic, including reliance on patched vulnerabilities like CVE-2020-9771 on older macOS builds.
Combined with its builder-driven configuration model, encrypted, campaign-specific settings, and build identifiers, the malware can quickly generate fresh variants, undermining static hash- or domain-based detection.
Security teams are advised to treat this as a behavioral detection problem: watch for ClickFix-driven Terminal execution, abnormal keychain access, LaunchDaemon persistence disguised as system services, and unexpected headless Chromium processes with active remote-debugging ports, since these patterns remain far more durable indicators than any single sample hash.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
