New AmnesiaStealer macOS malware hijacks browser sessions via remote control
A new information-stealing malware called AmnesiaStealer targets macOS users via ClickFix attacks, including a streaming module that allows the attacker to interactively control the victim's web browser. The malware can collect data in 16 Chromium-based web browsers as we…
Intelligence analysis by Llama
AmnesiaStealer is a new information-stealing malware that targets macOS users via ClickFix attacks. It includes a streaming module that allows the attacker to interactively control the victim's web browser and collect sensitive information.
Imagine someone can take control of your web browser and see everything you're doing online, including your passwords and credit card numbers. This is what the AmnesiaStealer malware can do. It's like having a ghost in the machine that can see everything you're doing and even control your browser.
Analysis
AmnesiaStealer's Distribution and Functionality
AmnesiaStealer is a new information-stealing malware that targets macOS users via ClickFix attacks. The malware is distributed through fake GitHub download pages that drop a password-protected ZIP archive containing the AmnesiaStealer Mach-O payload. The ClickFix command executes a shell-script loader that downloads and launches the password-protected archive.
Stealing the Admin Password
The malware captures the victim's macOS password and uses it to collect keychain data, as well as browser profiles, Apple Notes, Telegram sessions, documents, system information, and cryptocurrency wallet data. The researchers highlight that the malware features a component called stream_module, retrieved using the remote_stream command, which gives the malicious operator remote control over authenticated sessions deployed from a headless browser instance.
Remote Control Over Authenticated Sessions
The stream_module can duplicate user profiles in seven Chromium-based browsers, including Google Chrome, Microsoft Edge, Vivaldi, Arc, Opera, Brave, and Chromium, because they share the same DevTools Protocol, launch flags, and cookie encryption. The module launches the legitimate browser executable in headless mode with command-line switches that weaken browser defenses, duplicates the victim's profile, and specifies its location for storing the profile data. The malware then establishes a WebSocket channel that connects to the operator's relay and sends a JSON registration message containing the browser name and build.
Live Screencast and Mouse Control
The operator can then send commands over this channel, such as navigation and mouse clicks, while the malware returns status and tab information as JSON and transmits screencast frames as binary WebSocket messages. A second WebSocket channel connects to the local headless Chromium instance through the browser's webSocketDebuggerUrl, providing access to the Chrome DevTools Protocol (CDP). This allows the hacker to navigate websites with mouse and keyboard control, export or import cookies, and operate online portals using the victim's existing authenticated sessions.
Exfiltrating Cookies and Profile Data
AmnesiaStealer can exfiltrate cookies, saved logins, browsing history, bookmarks, extensions, local state, and other profile data from the 16 Chromium-based browsers it targets. It also steals cryptocurrency wallet details and identifies them by enumerating extensions and IndexedDB data. Jamf notes that the malware contains a fallback mechanism when it runs on macOS 26 and cannot recover the existing Chrome Safe Storage key, which replaced it with an attacker-supplied value. This makes previously stored cookies and passwords permanently unreadable while allowing the attacker to decrypt data later.
Key points
- AmnesiaStealer is a new information-stealing malware that targets macOS users via ClickFix attacks.
- The malware includes a streaming module that allows the attacker to interactively control the victim's web browser.
- AmnesiaStealer can collect data in 16 Chromium-based web browsers as well as other sensitive information.
- The malware contains a fallback mechanism when it runs on macOS 26 and cannot recover the existing Chrome Safe Storage key.
- This makes previously stored cookies and passwords permanently unreadable while allowing the attacker to decrypt data later.
If this malware is detected and removed quickly, the damage can be minimized. Additionally, if users are cautious and don't execute unknown terminal commands, they can avoid falling victim to this type of attack.
The AmnesiaStealer malware is a sophisticated threat that can evade detection and cause significant harm. If users are not careful and execute unknown terminal commands, they can fall victim to this type of attack and lose sensitive information.
