Security researchers have uncovered AmnesiaStealer, a sophisticated Rust-based information-stealing malware targeting macOS users. Unlike traditional stealers that simply collect credentials and browser data, AmnesiaStealer can hijack active Chromium browser sessions and provide attackers with real-time remote control over a victim's authenticated browsing activity.
Distributed Through Fake GitHub Downloads
The malware is delivered through a fraudulent GitHub download page masquerading as a legitimate macOS application. The page uses a ClickFix-style social engineering technique, instructing users to copy and execute a Base64-encoded command in the macOS Terminal.
Once executed, the command launches a multi-stage infection chain that downloads and deploys AmnesiaStealer from attacker-controlled infrastructure.
According to researchers at Jamf Threat Labs, the attack consists of three primary stages:
- A shell script downloader that retrieves and launches the malware.
- A Rust-based information stealer that collects sensitive user data.
- An optional remote-browser-control module that enables live interaction with the victim's browser.
Built for Stealth and Flexibility
The initial script downloads a password-protected ZIP archive, removes itself from the system, and launches a Rust-based payload. The malware contains an encrypted configuration that allows operators to modify behavior without altering the codebase.
Features include configurable command-and-control (C2) infrastructure and an optional cryptocurrency clipper module capable of replacing wallet addresses for assets such as Bitcoin, Ethereum, Solana, Monero, Litecoin, Ripple, TRON, and Cosmos.
Credential Theft and System Reconnaissance
AmnesiaStealer performs extensive reconnaissance of the compromised device, collecting system information and geographic data. It then displays a fake installer prompt designed to capture the user's macOS password.
To ensure accuracy, the malware verifies the password against macOS directory services. If an incorrect password is entered, the victim is repeatedly prompted until valid credentials are supplied.
The captured password is subsequently used to:
- Unlock the user's Keychain
- Access protected files and sensitive data
- Perform privileged system operations through sudo
- Store credentials in plaintext for later use
Researchers noted that similar password-harvesting techniques have been observed in other macOS malware families, including ClickLock Stealer.
Extensive Data Theft Capabilities
Once credential access is obtained, the malware targets a broad range of sensitive information, including:
- Apple Keychain credentials
- Apple Notes content
- Telegram session data
- Safari browsing data
- Documents and files stored on Desktop, Documents, and Downloads folders
- Various file types including PDF, DOC, TXT, CSV, RTF, JPG, PNG, wallet, and key files
The malware also targets data stored within 16 Chromium-based browsers, including:
- Google Chrome
- Microsoft Edge
- Brave
- Arc
- Chromium-derived browsers
Collected data includes:
- Cookies
- Saved passwords
- Browsing history
- Bookmarks
- User preferences
- Extension data
- Authentication tokens
Additionally, AmnesiaStealer attempts to recover Chrome encryption keys from macOS Keychain to decrypt protected browser information.
Establishing Persistence
To survive system reboots, the malware installs a root-level LaunchDaemon disguised as Apple's crash reporting service.
Stolen information is staged in randomly named temporary directories before being compressed and exfiltrated to attacker-controlled servers.
Live Browser Hijacking Capability
The most notable feature of AmnesiaStealer is its secondary remote-control module.
When instructed by the command-and-control server, the malware downloads an additional Rust payload capable of controlling Chromium browsers through the Chrome DevTools Protocol (CDP).
Supported browsers include:
- Chrome
- Edge
- Brave
- Arc
- Opera
- Vivaldi
- Chromium
The module launches a hidden headless browser session while maintaining access to the victim's authenticated accounts. Through a WebSocket connection, attackers can remotely:
- Navigate websites
- Click links and buttons
- Type keystrokes
- Scroll pages
- Manage tabs
- Interact with web applications in real time
To avoid detection, the malware modifies browser fingerprinting APIs, making automated browser activity appear more like normal human behavior.
Researchers emphasized that this functionality goes far beyond traditional cookie theft or credential harvesting.
More Than a Typical macOS Stealer
While AmnesiaStealer shares characteristics with known macOS threats such as Atomic Stealer, MacSync, and CrashStealer, several features distinguish it:
- Builder-driven and highly configurable architecture
- Operating-system-specific logic that attempts to exploit older macOS bypass techniques
- A dedicated browser-hijacking stage enabling live, operator-controlled sessions
Researchers named the malware after its backend login portal, titled "Amnesia Panel," which reportedly returns Russian-language login errors when incorrect credentials are entered.
Why It Matters
AmnesiaStealer represents an evolution in macOS malware. Beyond stealing files, passwords, and browser data, it enables attackers to operate within a victim's active browser sessions, bypassing many traditional authentication protections. This ability to gain live access to authenticated accounts significantly increases the threat posed by the malware and makes it a noteworthy development for defenders tracking macOS-focused cybercrime.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
