A new macOS infostealer, dubbed AmnesiaStealer, has been identified with capabilities to exfiltrate sensitive user data and manipulate browser sessions. The malware, reportedly written in Rust, targets a range of credentials and browser-specific information from compromised systems.
Technical analysis indicates that AmnesiaStealer focuses on several critical data points. It is designed to harvest user passwords, which could include system login credentials or application-specific passwords. Furthermore, the malware targets macOS keychain information, a secure storage system for passwords, private keys, and certificates, which could grant attackers access to a wide array of encrypted data.
Beyond system-level credentials, AmnesiaStealer specifically targets browser data. It is reported to extract information from Chromium-based browsers, a category that includes popular applications like Google Chrome, Microsoft Edge, and Brave. This data typically encompasses saved passwords, browsing history, autofill data, and potentially session cookies. The malware also specifically targets Safari cookies, which could allow attackers to hijack active user sessions on websites without needing to re-authenticate.
The use of Rust for malware development is notable, as the language offers performance benefits and memory safety features that can make reverse engineering more challenging and the malware itself more robust. This choice of language reflects a trend among some threat actors to adopt modern programming languages that may evade traditional signature-based detections more effectively.
For users, typical mitigation strategies against this class of infostealer include maintaining up-to-date operating systems and applications, employing robust endpoint detection and response (EDR) solutions, and exercising caution with unsolicited downloads or email attachments. Regularly backing up critical data and using strong, unique passwords, ideally managed with a reputable password manager, can also limit the impact of a successful compromise. Furthermore, enabling multi-factor authentication (MFA) on all possible accounts significantly reduces the risk of session hijacking even if credentials are stolen.
The emergence of AmnesiaStealer underscores the persistent threat posed by infostealers targeting the macOS ecosystem. As macOS continues to gain market share, it increasingly becomes a more attractive target for cybercriminals. The focus on browser session control highlights a shift towards exploiting active user sessions for financial gain or further network penetration, rather than solely relying on static credential theft.
