Jamf Threat Labs researchers have uncovered AmnesiaStealer, a new Rust-based macOS infostealer that provides attackers with live, hidden control over a victim's web browser. The multi-stage malware, first observed on August 14, 2026, spreads through convincing fake GitHub download pages that employ the "ClickFix" technique.
These deceptive GitHub pages mimic the legitimate site's dark theme, Octocat logo, and "Verified Publisher" badge. Instead of a direct download button, they prompt users to execute a Terminal command. This lure infrastructure, including the specific fake GitHub template, has also been linked to past Atomic Stealer and MacSync campaigns, suggesting a shared operational framework among multiple malware families.
AmnesiaStealer operates in three distinct stages. The initial stage involves a shell script that downloads and executes the primary payload. The second stage is a Rust-based infostealer designed to harvest sensitive data from the macOS keychain, various web browsers, Apple Notes, and Telegram. The third and most distinctive stage is a "stream_module," which is fetched on command and grants the attacker interactive, covert control over the victim's browser session.
Unlike typical infostealers that merely exfiltrate files, the "remote_stream" command transforms the compromised machine into a live browser session. Attackers can then manipulate this session in real time, including keyboard input, mouse clicks, navigation, and tab management, all while the victim's own browser window remains untouched and displays no unusual activity. The stream module achieves this by cloning the victim's browser profile and launching it in a headless mode, providing the operator with live, hidden control over the session state.
The Rust payload initiates by presenting a native macOS password prompt disguised as an Installer dialog. It locally validates the entered password against the directory service using `dscl`, repeatedly prompting for correction until the correct password is provided. This captured password is then used throughout the attack chain: it is piped into `sudo -S` for privileged reads, passed to `security unlock-keychain -p`, and written to disk in cleartext, both in the staging directory as `pwd` and in the user's home directory as `~/.pwd`.
With the password in hand, the malware proceeds to unlock the login keychain, read Apple Notes via `sudo cat`, and sweep the Desktop, Documents, and Downloads folders for documents and wallet files. It specifically targets 16 Chromium-family browsers to steal cookies, credentials, browsing history, and extension data. A notable behavior on macOS 26 is AmnesiaStealer's handling of Chrome’s Safe Storage key. If the malware cannot retrieve the key normally, it deletes and replaces it with a known key. While this allows attackers to decrypt newly stolen passwords and cookies, it may render previously stored data inaccessible. This activity, as legitimate browsers do not typically delete and recreate Safe Storage entries via the `security` command, can serve as a valuable detection signal.
The stream module's cookie theft mechanism leverages the Chrome DevTools Protocol, calling `Network.getAllCookies` against the headless browser session. This returns plaintext cookie values because the browser has already decrypted them in memory, effectively bypassing at-rest encryption. The module also injects a stealth script via `Page.addScriptToEvaluateOnNewDocument` to patch browser fingerprinting APIs, preventing the headless session from being flagged as automation by visited websites.
For persistence, AmnesiaStealer installs itself as a root LaunchDaemon, impersonating Apple's crash reporting service, `com.apple.ReportCrash.agent`, with a random numeric suffix. This configuration ensures the malware survives reboots under the console user's account. The command and control (C2) backend, dubbed "Amnesia Panel," resides at the root of the delivery domain and displays Russian error messages upon failed login attempts.
Infrastructure analysis reveals a consistent URL pattern, `/d/command?t=token&b=build`, across multiple domains resolving to the same IP address. This pattern is indicative of a builder that generates per-campaign configurations, embedding them in the payload as an XOR-encrypted blob. The malware's family name, the Russian error messages, and the shared lure templates with other known stealers suggest an established and ongoing operation rather than an isolated experiment. While AmnesiaStealer aims to harvest credentials, browser data, and live sessions from macOS users, its effective collector and browser-hijack stages, combined with some outdated bypass techniques, make it a significant threat to monitor.
