A new information-stealing malware, dubbed AmnesiaStealer, is targeting macOS users through "ClickFix" campaigns, according to research from Jamf. The malware's notable capability is its "stream_module," which allows attackers to remotely control a victim's web browser through a hidden, headless instance, effectively hijacking authenticated sessions.
AmnesiaStealer is distributed via fake GitHub download pages that prompt users to download a password-protected ZIP archive. These ClickFix campaigns employ a shell-script loader to retrieve and launch the archive containing the AmnesiaStealer Mach-O payload. This distribution method has previously been observed in campaigns spreading the Atomic and MacSync infostealers.
Once executed, AmnesiaStealer attempts to capture the victim's macOS password. This credential is then used to exfiltrate sensitive data, including keychain information, browser profiles, Apple Notes, Telegram sessions, documents, system details, and cryptocurrency wallet data. The malware is designed to collect data from 16 Chromium-based web browsers.
The "stream_module" component, activated via the "remote_stream" command, is central to AmnesiaStealer's advanced capabilities. It can duplicate user profiles in seven specific Chromium-based browsers: Google Chrome, Microsoft Edge, Vivaldi, Arc, Opera, Brave, and Chromium. This is possible due to their shared DevTools Protocol, launch flags, and cookie encryption mechanisms.
The module operates by launching the legitimate browser executable in a headless mode, using command-line switches that weaken its inherent defenses. It then duplicates the victim's browser profile, specifying a new location for storing the profile data. A WebSocket channel is established to connect to the attacker's relay, sending a JSON registration message with the browser's name and build.
Through this channel, the attacker can send commands such as navigation and mouse clicks. The malware responds with status and tab information in JSON format, and transmits screencast frames as binary WebSocket messages at approximately 3 frames per second. A second WebSocket channel connects to the local headless Chromium instance via the browser’s "webSocketDebuggerUrl," providing access to the Chrome DevTools Protocol (CDP).
This CDP access enables the attacker to navigate websites, control mouse and keyboard input, export or import cookies, and operate online portals using the victim's existing authenticated sessions. This effectively turns the infected host into a live, operator-driven browser running the victim's authenticated sessions, offering a significantly deeper level of access than mere file collection.
Beyond live session hijacking, AmnesiaStealer can exfiltrate cookies, saved logins, browsing history, bookmarks, extensions, local state, and other profile data from the 16 targeted Chromium-based browsers. It also identifies and steals cryptocurrency wallet details by enumerating extensions and IndexedDB data.
A notable fallback mechanism exists for macOS 26, where if the malware cannot recover the existing Chrome Safe Storage key, it replaces it with an attacker-supplied value. This renders previously stored cookies and passwords permanently unreadable to the user while allowing the attacker to decrypt the data later.
While the Chrome DevTools Protocol has been abused by other malware, such as Chaos ransomware for C2 communications and Chaes malware for data theft, AmnesiaStealer is reportedly the first documented macOS malware to combine a cloned Chromium profile with CDP-based, live remote control to interact with authenticated sessions through a hidden browser on the infected machine. Users are advised to exercise caution and avoid executing unfamiliar terminal commands found online.
