A new macOS infostealer is being distributed via ClickFix social engineering attacks, researchers from Jamf have warned.
The Rust infostealer, dubbed AmnesiaStealer, has multiple stages and objectives once it has infected a victim device, including harvesting credentials, browser data and live sessions.
While its objectives overlap with other macOS infostealers such as Atomic (AMOS), MacSync and CrashStealer, the researchers noted that AmnesiaStealer has macOS-specific capabilities that make it a novel threat.
It contains OS version-branched logic that reaches for macOS bypasses that have been patched by Apple.
In addition, it contains a remote-controlled second stage, which gives the operator hidden, interactive control of the victim’s browser.
AmnesiaStealer is particularly adept at maintaining stealth during its activities, making detection difficult.
How the AmnesiaStealer Campaign Unfolds
The Jamf report, published on August 13, highlighted the attackers’ use of ClickFix to distribute AmnesiaStealer to mac users.
In ClickFix-style attacks, the user enters the command, which bypasses many anti-virus and cyber defense tools that categorise the action as legitimate. It typically uses a fake error or verification message to manipulate victims into copying and pasting a malicious script and then running it.
The tactic preys on users’ desire to fix problems themselves rather than alerting their IT team. Therefore, it is effective at bypassing security protections as the victim infects themselves.
Research has shown that ClickFix has become a leading means of malware delivery in 2026.
The AmnesiaStealer ClickFix lure uses a counterfeit GitHub download page, which presents a "Terminal installation" box framed as a convenience for advanced users. It provides numbered instructions to open and install Terminal.
The researchers noted that this lure template is shared across multiple macOS infostealer families.
If the user clicks the ‘copy’ button, a base64 blob is produced which decodes to a single command. This command retrieves a script that is short, silent and self-deleting.
This script executes the AmnesiaStealer binary, which sets about malicious activities culminating in the exfiltration of a range of data.
It begins by ‘muting’ the device’s sound system to hide its data theft activities. This is because part of the data collection runs through Finder, which plays a sound on each file it duplicates.
It also performs reconnaissance across software, hardware and display data types.
AmnesiaStealer first harvests data from Apple Notes and Telegram, writing commands that ensure it avoids triggering a macOS permission (TCC) prompt.
Next, the malware prompts the victim to enter their password, which, when entered, is validated locally. These credentials are used to unlock data-protection keychain files that hold encrypted records. The researchers said that at the time of analysis, it is not clear why these records are collected.
Collected data is staged in a directory and then archived, before exfiltration is carried out.
The next stage of the campaign comes with the launch of a second binary, which enables threat actors to take remote control of victims’ browsers. The module supports seven Chromium-family browsers, which include Chrome, Brave, Microsoft Edge, Arc, Opera, Vivaldi and Chromium.
This activity remains invisible to the user because before launch the module clones the victim profile. Control is taken over the copy, meaning that the victim’s own visible browser is not affected.
Under this function, the operator receives a live screencast of the session and can drive it using a full input set of keyboard, mouse, scroll, navigation and tab management.
The module is then able to steal browser cookie data in plaintext over the DevTools protocol. It evades detection by injecting a script which keeps the session from being flagged as automation by the sites it visits.
Jamf advised macOS users to configure threat prevention, advanced threat controls and web protection to Block and Report to help prevent the execution of similar threats.