AmnesiaStealer Browser Hijack Raises Stakes for macOS

Jamf Threat Labs has documented a new macOS infostealer that goes beyond typical credential theft, adding a module that gives attackers quiet, interactive control over a victim's Chromium browser. Dubbed AmnesiaStealer, the malware uses a ClickFix-style fake GitHub page to trick users into running a Terminal command that installs the payload.

The campaign, detailed in a Jamf blog post, is designed to steal credentials and sensitive data before escalating into silent, interactive control of the victim's Chromium browser. The attack was found mimicking GitHub's dark theme, Octocat branding, and a "Verified Publisher" badge, luring victims with a fake "Download for macOS" workflow.

Fake GitHub Lures Victims to Terminal

The social-engineering component involves a fake site that tricks users into pasting a command into Terminal instead of providing the promised application. That command retrieves a shell script from attacker infrastructure, which then downloads a password-protected ZIP containing the main malware.

Password-protecting the ZIP is likely an attempt to complicate automated inspection, the researchers noted. The loader takes several steps to make the payload harder to notice, including extracting the binary into "/tmp," giving it a hidden Apple-looking filename, removing the macOS quarantine attribute, applying an ad-hoc code signature, and launching it silently before deleting the executable.

Rust-Based Payload Targets Intel and Apple Silicon

The final payload is a Rust-based universal Mach-O binary, built for both Intel and Apple silicon Macs. Jamf said it can collect the macOS login password through a native-looking prompt, as well as target the Keychain, browser data, Apple Notes, Telegram session information, and files.

Additionally, the malware contains logic for attempting older macOS security bypasses, although Jamf observed most of them failing as Apple has already patched the underlying weaknesses.

Browser Session Hijacking Module

The unusual part of AmnesiaStealer arrives through its third stage. When instructed by the command-and-control (C2) infrastructure, the malware downloads a separate Rust-based "stream_module" that launches a cloned browser profile and establishes a WebSocket connection with the attacker.

The module turns the victim's browser into a remotely operated session. Supported commands include opening and closing tabs, navigating, scrolling, keyboard and mouse interaction, and exporting cookies. Browser cookies could be exported in plaintext through the DevTools Protocols.

Why This Threat Stands Out

Jamf pointed out that stealing an already-authenticated browser session can allow an attacker to operate with the victim's existing access. A compromised Mac therefore becomes a remotely controlled browser endpoint, apart from leaking credentials and documents.

The same fake download template has been used to distribute other macOS stealers including Atomic (AMOS) and MacSync, according to Jamf. The Rust-based Amnesia, however, adds a dedicated module for providing attackers with covert browser control. A "working collector paired with a working browser-hijack stage" makes the threat worth tracking, the researchers pointed out.

Recommendations for Organizations

Jamf recommended that organizations block indicators of compromise associated with the campaign and monitor for suspicious activity matching AmnesiaStealer's behavior. The blog post includes IOCs covering the malware's infrastructure, files, and hashes, including the domains used to deliver the payload.

Educating enterprise users about ClickFix-style attacks, particularly fake websites that instruct them to paste commands into Terminal, and ensuring macOS endpoints are kept up to date was also advised.

Implications for Mac Users

This campaign underscores the evolving sophistication of macOS-targeted malware, with attackers moving beyond simple credential theft to seize control of authenticated browser sessions. For enterprises, the ability to operate with a victim's existing access poses a significant risk, potentially enabling lateral movement or data exfiltration.

While Apple has patched many older security bypasses, the reliance on social engineering remains a glaring weakness. Users should be wary of any website instructing them to open Terminal and paste commands, even if it mimics trusted brands like GitHub. Keeping macOS updated and educating users about such tactics are critical defensive measures.