AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS
Jamf details AmnesiaStealer, a new Rust-based macOS infostealer that hijacks Chromium sessions for live attacker-controlled browser access and steals Keychain data.
Jamf Threat Labs disclosed a three-stage macOS infostealer called AmnesiaStealer distributed via a fake GitHub download page using a ClickFix-style lure that tricks users into pasting a Base64 command into Terminal. The Rust payload harvests the Keychain, Apple Notes, Telegram sessions, Safari cookies, and 16 Chromium-family browsers, and captures the system password via a native prompt validated with dscl. A remotely fetched stream_module gives operators hidden, interactive browser control via the Chrome DevTools Protocol, streaming a live session at roughly 3fps. It persists via a root LaunchDaemon impersonating Apple's crash reporter and leverages the TCC bypass CVE-2020-9771 against macOS Catalina.
- Dropped through fake GitHub page with ClickFix Base64 Terminal command lure.
- Rust stealer has builder-driven encrypted configuration including C2 and clipper module.
- Clipper module targets Bitcoin, Ethereum, Monero, Solana, and other cryptocurrencies.
- Remote stream module enables hands-on-keyboard control of victims' authenticated browser sessions.
- Captured password reused for sudo, Keychain unlocking, and written in cleartext.
- CVEs
- CVE-2020-9771
- Vendors
- Jamf Threat Labs
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-9771 | This issue was addressed with a new entitlement | 7.1 | <1% |
From the original article
5 min read at thehackernews.com
Cybersecurity researchers have disclosed details of a new macOS-oriented, Rust-based information stealer called AmnesiaStealer that's capable of hijacking Chromium web browsers to steal session data. The multi-stage stealer is spread via a counterfeit GitHub download page titled "Download for macOS" and claims to be from a verified publisher.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.