AmnesiaStealer MacOS malware that steals credentials and controls real-time browser sessions

Security researchers have documented a new malware family aimed at macOS - called AmnesiaStealer - that combines a dropper in shell, an infostealer written in Rust and a remote module that allows the attacker to control real-time Chromium browser sessions. The reported initial vector is a false download page for macOS that emulates GitHub and persuades the victim to copy and paste into Terminal a command encoded in Base64, a "ClickFix" type technique that has been used in previous campaigns.

Confirmed facts: analysis teams, including the Jamf Threat Labs group, have broken the infection chain in at least three stages. The first runs a shell script that downloads and starts the payload; the second is a Mach-O binary written in Rust that collects credentials and sensitive data (Keychain, Chromium browsers, Safari according to version, Apple Notes, Telegram and local files); the third is a "stream _ module" that, when requested from the command and control server (C2), download a second binary that launches a Chromium browser in headless mode and exposes a remote interface for the operator to interact with the authenticated CDP and the victim's (CDP). Jamf also indicates that the binary configuration contains editable parameters in compilation time, including endpoints C2 and the activation of a clipper module to steal cryptomonedas.

Technically, AmnesiaStealer takes advantage of several steps that deserve attention: the initial deception forces the user to run code without checking; the dropper downloads a password-protected ZIP file and removes a Mach-O; that Rust binary makes recognition of the computer, requests the system password with a native dialog (and validates the dscl response against the local directory to accept only the right password), and reuses that password to unlock the key, run privileged readings and decrypt data saved by browsers. The last stage can launch the victim's browser in "headless" mode, patching Fingerprinting APIs to avoid detections and allow the attacker to control the browser as if it were sitting in front of the computer, with low-rate screen transmission of frames and complete keyboard and mouse control translated into CDP calls.

What affects and how serious it is: the main objective are macOS users with active browser sessions and sensitive data stored in Keychain or local applications. The remote browser control component raises the risk: not only are files and credentials stolen, but the operator can use already authenticated web sessions (e.g. online banking, mail accounts or business panels) without knowing passwords, which facilitates unauthorized transfers, configuration changes or access to corporate data. In addition, malware tries to persist through a LaunchDaemon that impersonates Apple's fault reporting service.

Confirmed parties vs estimates and uncertainties: it is confirmed that the code recovers Keychain and data from multiple Chromium browsers and that it can use a known bypass TCC (CVE-2020-9771) to steal cookies in certain old versions of macOS; however, the actual scope of infections, the identity of operators and precise geographical objectives are not published in a comprehensive manner. Previous reports from similar families (e.g., ClickLock) have shown campaigns against users in Europe, North America, the Middle East and Africa, suggesting that attackers use geographically wide phishing, but there is no firm public attribution for AmnesiaStealer yet.

Practical consequences: if a team has been compromised by this threat it is likely that the credentials stored in browsers and Keychain have been exposed, active session tokens can be reused and local files copied. The presence of the remote module means that even you have changed passwords could still be used if the sessions have not been closed on all devices or if the attackers have captured cookies and tokens.

Specific and prioritized measures to be taken by the reader

Before running commands: never paste or run on Terminal commands received from web pages or chats unless you understand exactly what they do. Check the URL, site certificate and file editor; in macOS, prefer downloads from the App Store or official sites signed by the developer. Activate Gatekeeper and avoid disabling security controls.

If you suspect that you have followed the deception: disconnect the Mac from the network immediately to stop the ongoing exfiltration. Use another clean device to start emergency changes to sensitive accounts and notify the financial institution if appropriate.

Technical controls and mediation: seek and eliminate suspicious persistence with commands such as inspecting / Library / LaunchDaemons and ~ /. LaunchAgens looking for non-legitimate plists; check running processes with Activity Monitor or ps; inspect / tmp by recent directories with random names and the existence of files like ~ / .pwd (which reports indicate that this malware comes to write in clear). Do not remove evidence if you need forensic support; document and capture listed before any deletion.

Credentials and meetings: change passwords from an uncompromised device and close web sessions (login from all devices) in critical services; revoke tokens OAuth and API, and enable or strengthen multifactor authentication (ideally with FIDO2 / hardware keys). For high sensitivity accounts, consider rotating SSH keys and locally stored certificates.

Keychain and macos: if Keychain may have been unlocked with the system password, consider creating a new access key and manually migrating clean credentials; in more serious cases, restoring the Mac and restoring from a secure pre-infection copy is the most reliable option. Update macOS to the latest version, as some techniques take advantage of bypasses already corrected above (see CVE-2020-9771 for technical context: MITRE CVE-2020-9771). More technical information and up-to-date detections are available at research centres of suppliers such as Jamf Threat Labs: Jamf Threat Center.

Organizational prevention: in corporate environments, apply execution blocking policies, use EDR / antimalware solutions with behavioral detection capacity (not only signatures), and block domains and URLs used for distribution and C2. Ask users about the risk of running commands in Terminal and avoid downloads of unverified repositories or pages even if they look "verified."

In short, AmnesiaStealer consolidates known techniques (social engineering of the "pasted commands" type, Keychain theft, browser passwords removal) with a remarkable ability: to convert legitimate browser sessions into a remote browser controlled by the attacker. This changes the risk from mere copy of files to active usurpation of real-time sessions. The defense combines common sense (not running unknown commands), technical protection (updates, Gatekeeper, EDR) and response procedures (isolate, rotate credentials, forensic) to minimize impact and recovery.