A new macOS infostealer, dubbed AmnesiaStealer, is being distributed through social engineering attacks that trick users into executing malicious commands, according to research published by Jamf on August 13. The Rust-based malware employs a multi-stage infection process to harvest credentials, browser data, and live user sessions.
AmnesiaStealer is notable for its macOS-specific capabilities, including OS version-branched logic designed to bypass previously patched Apple security measures. It also features a remote-controlled second stage that grants attackers hidden, interactive control over a victim's web browser, making detection particularly challenging.
The distribution method, known as "ClickFix," leverages fake error or verification messages to manipulate users into copying and pasting a malicious script into their Terminal and executing it. This technique bypasses many conventional security tools because the user's action is categorized as legitimate, effectively causing victims to infect themselves. ClickFix has been identified as a significant malware delivery vector in 2026.
In the AmnesiaStealer campaign, the ClickFix lure appears as a counterfeit GitHub download page, presenting a "Terminal installation" box for "advanced users." This template is reportedly shared across various macOS infostealer families. If a user clicks the "copy" button, a base64-encoded command is produced. This command retrieves a short, silent, and self-deleting script that then executes the AmnesiaStealer binary.
Upon execution, AmnesiaStealer first mutes the device's sound system to conceal its data theft activities, as some data collection processes involving Finder would otherwise play a sound for each duplicated file. It then performs reconnaissance on software, hardware, and display data. The malware prioritizes data from Apple Notes and Telegram, using commands designed to avoid triggering macOS permission (TCC) prompts.
Subsequently, AmnesiaStealer prompts the victim to enter their password, which is validated locally. These credentials are used to unlock data-protection keychain files containing encrypted records, though the specific purpose for collecting these records was unclear at the time of analysis. Collected data is staged in a directory, archived, and then exfiltrated.
The second stage of the attack involves launching an additional binary that enables threat actors to remotely control the victim's browser. This module supports seven Chromium-family browsers, including Chrome, Brave, Microsoft Edge, Arc, Opera, Vivaldi, and Chromium. The module operates invisibly by cloning the victim's browser profile and controlling the copy, leaving the visible browser unaffected.
During this remote control phase, the operator receives a live screencast of the session and can interact with it using full keyboard, mouse, scroll, navigation, and tab management inputs. The module is capable of stealing browser cookie data in plaintext via the DevTools protocol and evades detection by injecting a script that prevents the session from being flagged as automation by visited websites.
Jamf recommends that macOS users implement threat prevention, advanced threat controls, and web protection configured to "Block and Report" to mitigate similar threats.
