What You Need to Know

The macOS ecosystem has long been considered a safe haven from the relentless barrage of malware that plagues other operating systems. However, a newly uncovered threat named AmnesiaStealer is shattering that illusion. Discovered by cybersecurity researchers at Jamf Threat Labs, this sophisticated, Rust-based information stealer is specifically engineered to compromise macOS environments. Its primary objective? To systematically hijack Chromium-based web browsers, harvest sensitive session data, and grant attackers unprecedented live control over the victim’s machine. This article delves deep into the mechanics of AmnesiaStealer, exploring how it operates, the techniques it uses to bypass built-in security, and what users can do to defend against it.

The Initial Vector: ClickFix and Fake Repositories

The initial attack vector for AmnesiaStealer relies heavily on social engineering, specifically leveraging a deceptive tactic known as “ClickFix.” Victims are often lured to counterfeit GitHub download pages that masquerade as legitimate software repositories. These pages prominently feature a “Download for macOS” button and falsely claim to be from a verified publisher. When a user interacts with the page, the ClickFix lure provides instructions to copy and paste a Base64-encoded command directly into the macOS Terminal application. This seemingly innocuous action is the catalyst for the entire attack chain, tricking the user into executing malicious code voluntarily.

A Three-Stage Execution Process

Once the initial command is executed, AmnesiaStealer deploys via a dropper script hosted on a remote server. The deployment process is executed in three distinct stages. The first stage involves a shell script that downloads a password-protected ZIP archive, extracts a payload, and then deletes itself to evade detection. The second stage deploys the core Rust infostealer, which performs extensive host reconnaissance, harvests data from the macOS Keychain, Apple Notes, and Telegram, and targets up to 16 different Chromium-family browsers. The final stage introduces a stream module fetched on command from the Command-and-Control (C2) server, granting the operator hidden, interactive control over the compromised browser.

Bypassing Apple Security and Stealing Credentials

A critical aspect of AmnesiaStealer is its ability to extract the system password to facilitate deeper exploitation. The malware presents a native-looking prompt, disguised as a standard system installer or update dialog, to trick the user into entering their credentials. The entered password is immediately validated against the local directory service using the dscl command. If incorrect, it traps the user in a continuous dialog loop. Once validated, this password is piped into privileged commands to unlock the Keychain and read cleartext files, providing the attacker with master keys used to secure data stored in Chrome profile folders.

“AmnesiaStealer sets out to harvest credentials, browser data, and live sessions from macOS users, and it delivers on some of that more than the rest,” noted Jamf Threat Labs. “A working collector paired with a working browser-hijack stage is what makes it worth tracking.”

Live Browser Hijacking via CDP

Perhaps the most alarming feature of AmnesiaStealer is its remote control capability via the Chrome DevTools Protocol (CDP). Upon receiving a remote_stream command, the malware spawns a headless browser session and establishes a WebSocket relay to the C2 infrastructure. This essentially turns the infected host into a live, operator-driven browser. The attacker receives a live screencast at approximately 3 frames per second and can interact with the browser using keyboard and mouse inputs, navigate pages, and manage tabs. Because the session utilizes the victim’s authenticated state, attackers can bypass multi-factor authentication (MFA) and access sensitive enterprise or personal accounts seamlessly.

Conclusion and Mitigation

To protect against threats like AmnesiaStealer, users must remain vigilant against social engineering tactics. Never copy and paste commands from unverified websites into the macOS Terminal. Ensure that your operating system and web browsers are always updated to the latest versions, as AmnesiaStealer has been known to exploit older macOS vulnerabilities (like CVE-2020-9771) to steal Safari cookies. Employing robust endpoint security solutions capable of detecting abnormal script execution and unauthorized Keychain access is also paramount in securing macOS environments against this evolving breed of malware.