MacOS AmnesiaStealer malware spread through ClickFix, grants live browser control

A new macOS infostealer dubbed AmnesiaStealer was discovered using the ClickFix social-engineering technique for initial access and includes a second stage that grants live control of Chromium browsers, Jamf reported Thursday.

The Rust-based stealer is installed through a fake GitHub “Download for macOS” page that instructs the victim to copy and paste a base64-encoded command to their Terminal. This command retrieves a dropper script that downloads a password-protected ZIP archive and then extracts and executes the AmnesiaStealer payload from the archive.

After performing basic reconnaissance, the malware uses AppKit NSAlert to display a password prompt stating “Installer wants to make changes.” Once the password is received and validated, the stealer goes after the user’s Keychain, Apple Notes and files.

Prior to beginning its stealing routine, the malware mutes the system sound to prevent the user from hearing the sound played when files are duplicated in Finder. While AmnesiaStealer mainly uses cat and cp commands to collect stolen files, duplicate is used for Safari cookies, Notes attachments, Safari Form Values, ~/Library/Keychains/<hardware UUID> (which contains Keychain-related cryptographic material) and any Notes not obtained via cat.

“Because duplicate makes Finder the process that reads each file, these steps access data the malware cannot directly reach without prompting the user. The Safari cookie step tries cat first and falls back to duplicate only when that fails,” Jamf Senior Threat and Detections Researcher Thijs Xhaflaire explained.

AmnesiaStealer targets files with the extensions txt, pdf, rtf, doc, key, jpg, png, csv and wallet. It uses generic pattern matching to search for potential cryptocurrency wallet browser extensions across Local Extension Settings, Extensions and IndexedDB rather than including specific hard-coded wallet names. The infostealer also targets Telegram session data.

For Chromium browser data theft, the malware targets 16 distinct browsers, including Google Chrome, Brave, Arc and Microsoft Edge. For each browser and profile, it copies the Extensions directory along with the following files: Cookies, Login Data, Login Data for Account, Web Data, History, Bookmarks, Local State and Preferences.

The researchers noted that some of the malware’s capabilities are held back by updates made by Apple in later macOS versions including macOS 26 (Tahoe), with some of these restrictions noted in debugging comments made by the malware developer. For example, one of the techniques it attempts to use for Safari cookie theft when other methods fail is an APFS snapshot bypass based on an exploit for CVE-2020-9771, which was patched by Apple in macOS Catalina 10.15.4 and 10.15.5. The technique now only works if the Terminal or malware process already hold Full Disk Access, which the researchers note may be possible in the case of “power users and developers.”

AmnesiaStealer also attempts to recover the Safe Storage password for each browser, but the malware author’s comments note “no keys recovered” on macOS 26 and above, leading to the use of a fallback method where the malware overwrites the Safe Storage password entirely with a hardcoded value, rendering any previously stored passwords and cookies undecryptable.

“This sequence is a high-value detection. Browsers create Safe Storage entries through the Security framework and never through the security binary, so a process deleting and rewriting one has no benign explanation,” the researchers note.

2nd stage enables live Chromium browser control

A second stage of the attack, triggered by a “remote_stream” command from the attacker’s command-and-control (C2) panel, returns a module that enables live remote-control of the victim’s Chromium browsers via the Chrome DevTools Protocol (CDP). This module works with a subset of seven browsers — Chrome, Brave, Edge, Arc, Opera, Vivaldi and Chromium itself — and spawns a headless version of the browser that can be fully controlled by the attacker.

The module clones the victim’s browser profile before launching the headless browser, allowing the attacker to control the browser through the victim’s logged-in profile. Two WebSockets form a relay channel to send operator commands to the browser and a 3 FPS screencast back to the attacker, with the attacker able to interact in real time via full keyboard and mouse inputs.

The module also steals browser cookies by calling Network.getAllCookies via CDP, writing the results to a Netscape cookie file that can then be imported to the attacker’s own browser. It also opens the Cookies database directly via SQLite and attempts to re-encrypt the cookies with the Safe Storage master key written in Stage 1, although the researchers noted that attempting to recreate this step in their lab environment failed on macOS 26.

The login page for the attacker’s C2 panel, titled “Amnesia Panel,” was found at the same domain that AmnesiaStealer and the remote control module were retrieved from; a failed login returns a Russian-language error message, the researchers observed.

While AmnesiaStealer shares similarities to other macOS stealers such as Atomic Stealer (AMOS), MacSync and CrashStealer and is spread through similar methods, its OS-version awareness and use of a live browser control module make it stand out, the researchers said.

“A working collector paired with a working browser-hijack stage, wrapped around a few dated bypasses, makes it worth tracking,” the researchers concluded.