42
30
AmnesiaStealer Gives Attackers Live Control of Victims’ macOS Browsers
Jamf Threat Labs analyzed AmnesiaStealer, a Rust-based macOS infostealer spread via fake GitHub pages that also grants live hidden browser control.
AmnesiaStealer is a three-stage Rust infostealer distributed through counterfeit GitHub download pages using the ClickFix technique, a lure shared with Atomic Stealer and MacSync campaigns. It harvests the keychain, 16 Chromium browsers, Apple Notes, Telegram and documents, reusing a password captured via a fake installer dialog. A third-stage stream module clones the victim's browser profile headlessly and lets operators drive the session via Chrome DevTools Protocol, while persistence uses a LaunchDaemon impersonating Apple's com.apple.ReportCrash.agent. On macOS 26 it may replace Chrome's Safe Storage key, a useful detection signal.
48
55
30
42
60
47
42
Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts
Huntress says rogue ScreenConnect clients spread a four-stage VBScript chain delivering backdoors, privilege-escalation tools, or an XMRig miner to newly connected hosts.
Huntress identified three unrelated August 2026 incidents using a Quick Assist tech-support scam, a phishing-delivered MSI installer, and a fake Geek Squad refund form to install rogue ScreenConnect clients. Each client repeatedly spawned wscript.exe to run 1.vbs through 4.vbs, which profiled the host, enumerated installed security products, and downloaded stage-specific payloads from Dropbox. Depending on detected state, payloads included a user-level ScreenConnect backdoor, UAC-bypass privilege escalation tooling, or tunneling utilities with an XMRig cryptocurrency miner. Infected clients re-infected newly connected hosts, creating worm-like propagation, and ConnectWise issued an advisory about affected file transfer behavior in ScreenConnect.
72
30
42
42
42
60
60
42
55
35
30
55
30
42
42
30
42
42
42
60
55
30
30
42
42
30
55
57
Week in review: Actively exploited Windows SMB flaw, trusted OAuth apps turned into cloud backdoors
60
30
42