30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS
Jamf details AmnesiaStealer, a new Rust-based macOS infostealer that hijacks Chromium sessions for live attacker-controlled browser access and steals Keychain data.
Jamf Threat Labs disclosed a three-stage macOS infostealer called AmnesiaStealer distributed via a fake GitHub download page using a ClickFix-style lure that tricks users into pasting a Base64 command into Terminal. The Rust payload harvests the Keychain, Apple Notes, Telegram sessions, Safari cookies, and 16 Chromium-family browsers, and captures the system password via a native prompt validated with dscl. A remotely fetched stream_module gives operators hidden, interactive browser control via the Chrome DevTools Protocol, streaming a live session at roughly 3fps. It persists via a root LaunchDaemon impersonating Apple's crash reporter and leverages the TCC bypass CVE-2020-9771 against macOS Catalina.
58
35
30
30
AmnesiaStealer Gives Attackers Live Control of Victims’ macOS Browsers
Jamf Threat Labs analyzed AmnesiaStealer, a Rust-based macOS infostealer spread via fake GitHub pages that also grants live hidden browser control.
AmnesiaStealer is a three-stage Rust infostealer distributed through counterfeit GitHub download pages using the ClickFix technique, a lure shared with Atomic Stealer and MacSync campaigns. It harvests the keychain, 16 Chromium browsers, Apple Notes, Telegram and documents, reusing a password captured via a fake installer dialog. A third-stage stream module clones the victim's browser profile headlessly and lets operators drive the session via Chrome DevTools Protocol, while persistence uses a LaunchDaemon impersonating Apple's com.apple.ReportCrash.agent. On macOS 26 it may replace Chrome's Safe Storage key, a useful detection signal.
48
30
30
30
30
30
30
30
30
30
30
30
30
MantaxOtax Android Malware Combines Ransomware With Spyware
Zimperium analyzed MantaxOtax Android malware combining AES file encryption with extensive spying, linked to Indonesian actors and distributed via sideloading.
Zimperium's zLabs published a technical analysis of MantaxOtax, an Android malware family that combines ransomware-style file encryption with comprehensive spyware, linked to Indonesian threat actors and distributed via sideloaded APKs on a third-party file-sharing service. The malware requests device administrator, SMS, contacts, storage and Accessibility permissions, resolves its C2 domain dynamically from a GitHub repository, and encrypts files with AES using per-device keys derived from the Android ID on Android 9 and earlier. It steals WhatsApp messages, Telegram credentials, OTPs and other data, and uses MediaProjection for screenshots and screen recording staged on Catbox; a second variant adds WebSocket C2 with persistent screen locking and app blocking.
45
30