AmnesiaStealer macOS infostealer targets browsersSecurity researchers at Jamf Threat Labs have identified a sophisticated macOS malware campaign that uses social engineering to compromise Mac users. The threat, named AmnesiaStealer, presents victims with fake GitHub download pages that mimic the platform’s dark theme, Octocat branding, and verification badges. Instead of delivering legitimate software, these pages instruct users to open Terminal, paste a malicious command, and enter their Mac password, initiating a multi-stage infection process.
The attack begins when the pasted Terminal command retrieves a shell script from attacker-controlled infrastructure, which then downloads a password-protected ZIP file containing the main malware payload. The loader employs several evasion techniques to avoid detection, including extracting the binary to the /tmp directory, assigning it a hidden Apple-like filename, removing macOS quarantine attributes, applying an ad-hoc code signature, and launching it silently before deleting the executable. The password protection on the ZIP file appears designed to bypass automated security scanning tools.
Once installed, the Rust-based universal Mach-O binary targets multiple data sources on infected systems. The malware captures the macOS login password through authentic-looking prompts and harvests information from Keychain, browser data stores, Apple Notes, Telegram sessions, and user files. The malware also attempts to exploit older macOS security bypasses, though Jamf researchers noted that most of these techniques now fail due to Apple’s security patches. The stealer works on both Intel and Apple silicon Mac architectures.
What distinguishes AmnesiaStealer from similar threats is its third-stage browser hijacking capability. When commanded by its control infrastructure, the malware downloads a separate stream_module component that launches a cloned browser profile and establishes a WebSocket connection with attackers. This module transforms the victim’s browser into a remotely operated session, supporting commands for opening and closing tabs, navigation, scrolling, keyboard and mouse interaction, and cookie export through DevTools Protocols. This capability allows attackers to operate with the victim’s existing authenticated sessions across web services.
Jamf researchers recommend that organizations implement blocking rules for known campaign indicators and monitor for suspicious activity patterns matching AmnesiaStealer’s behavior. The research team has published indicators of compromise including infrastructure domains, file hashes, and delivery mechanisms. Security teams should prioritize user education about ClickFix-style attacks that request Terminal command execution and ensure all macOS endpoints receive timely security updates. The same fake download template has previously been used to distribute other macOS stealers including Atomic (AMOS) and MacSync, indicating an established distribution infrastructure.
Source: https://www.csoonline.com/article/4210464/new-macos-malware-turns-stolen-browsers-into-attacker-controlled-sessions.html