Jamf Threat Labs researchers disclosed AmnesiaStealer, a new multi-stage Rust-based macOS infostealer that spread through a counterfeit GitHub download page using the ClickFix technique.
The lure looks convincing: correct GitHub dark theme, Octocat logo, “Verified Publisher” badge, and instead of a download button, it asks the visitor to paste a Terminal command. The same fake GitHub template has been observed in Atomic Stealer and MacSync campaigns, which means the lure infrastructure is shared across multiple malware families.
“AmnesiaStealer runs in three stages: The first is a shell script that downloads and launches the payload. The second is a Rust infostealer that harvests the keychain, browsers, Apple Notes and Telegram. The third is a stream_module
, fetched on command, that gives the operator hidden, interactive control of the victim’s browser.” reads the report published by Jamf Threat Labs.
The third stage is the part that separates AmnesiaStealer from commodity stealers. Rather than just dumping files, the remote_stream command turns the infected machine into a live browser session the operator can drive in real time, keyboard input, mouse clicks, navigation, tab management, all while the victim’s own browser window stays untouched and shows nothing unusual.
“The stream module clones the victim’s browser profile, launches it headless and gives the operator live, hidden control of the session” states the report.
The Rust payload starts by displaying a native macOS password prompt styled as an Installer dialog.
It validates the password locally against the directory service using dscl, looping with “Incorrect password. Please try again” until the right one is entered.
“The captured password is then reused throughout the chain. It is piped into sudo -S
for privileged reads, passed to security unlock-keychain -p
, and written to disk in cleartext, both in the staging directory as pwd
and in the user’s home directory as ~/.pwd
.” continues the report.
With the password in hand the malware unlocks the login keychain, reads Apple Notes via sudo cat, sweeps Desktop, Documents, and Downloads for documents and wallet files, and targets 16 Chromium-family browsers for cookies, credentials, history, and extensions data.
A behavior worth watching on macOS 26 is how AmnesiaStealer handles Chrome’s Safe Storage key. If it cannot retrieve the key normally, the malware deletes it and replaces it with a key it already knows. This lets attackers decrypt newly stolen passwords and cookies, while potentially making previously stored data inaccessible. Since legitimate browsers do not normally delete and recreate Safe Storage entries through the security
command, this activity can be a useful detection signal.
The stream module’s cookie theft works through Chrome DevTools Protocol: it calls Network.getAllCookies against the headless browser session, which returns plaintext cookie values because the browser has already decrypted them in memory. This sidesteps at-rest encryption entirely. The module also injects a stealth script through Page.addScriptToEvaluateOnNewDocument to patch browser fingerprinting APIs, keeping the headless session from being flagged as automation by the sites visited. Persistence is installed as a root LaunchDaemon impersonating Apple’s crash reporting service, com.apple.ReportCrash.agent with a random numeric suffix, configured to survive reboots under the console user’s account.
The C2 backend is named Amnesia Panel, sits at the root of the delivery domain, and returns error messages in Russian when login fails. Infrastructure analysis shows the same URL pattern, /d/command?t=token&b=build, across multiple domains resolving to the same address, consistent with a builder that generates per-campaign configurations and embeds them in the payload as an XOR-encrypted blob. The family name, the Russian error messages, and the shared lure templates with other known stealers suggest an established operation rather than a one-off experiment.
“AmnesiaStealer sets out to harvest credentials, browser data and live sessions from macOS users, and it delivers on some of that more than the rest.” concludes the report. “A working collector paired with a working browser-hijack stage, wrapped around a few dated bypasses, makes it worth tracking.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, AmnesiaStealer)