AmnesiaStealer Gives Attackers Live Control of Victims’ macOS Browsers
Jamf Threat Labs analyzed AmnesiaStealer, a Rust-based macOS infostealer spread via fake GitHub pages that also grants live hidden browser control.
AmnesiaStealer is a three-stage Rust infostealer distributed through counterfeit GitHub download pages using the ClickFix technique, a lure shared with Atomic Stealer and MacSync campaigns. It harvests the keychain, 16 Chromium browsers, Apple Notes, Telegram and documents, reusing a password captured via a fake installer dialog. A third-stage stream module clones the victim's browser profile headlessly and lets operators drive the session via Chrome DevTools Protocol, while persistence uses a LaunchDaemon impersonating Apple's com.apple.ReportCrash.agent. On macOS 26 it may replace Chrome's Safe Storage key, a useful detection signal.
- Three-stage Rust payload delivered via fake GitHub page and ClickFix
- Stream module gives operators hidden, live control of victim's browser
- Steals keychain, 16 Chromium browsers, Notes, Telegram and wallet files
- Persistence via LaunchDaemon impersonating Apple crash reporter service
- Shares lure infrastructure with Atomic Stealer and MacSync
- ATT&CK
- T1059.004 Unix ShellT1555.001 KeychainT1555.003 Credentials from Web BrowsersT1543.004 Launch Daemon
- Vendors
- Jamf Threat Labs
- Organizations
- GitHub
From the original article
3 min read at securityaffairs.com
AmnesiaStealer targets macOS users through fake GitHub pages, stealing passwords, cookies and data while giving attackers live control of the browser. Jamf Threat Labs researchers disclosed AmnesiaStealer, a new multi-stage Rust-based macOS infostealer that spread through a counterfeit GitHub download page using the ClickFix technique.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.