AmnesiaStealer Hijacks macOS Browser Sessions

Jamf researchers have documented a new Rust-built macOS infostealer named AmnesiaStealer, delivered through counterfeit GitHub download pages using ClickFix social engineering. It doesn’t just steal credentials — it overwrites macOS Safe Storage keys afterward, leaving saved browser passwords permanently unrecoverable. Findings were reported by SecurityWeek on August 14.

What it steals

The infection runs a three-stage chain triggered by a ClickFix terminal-paste prompt. A LaunchDaemon lands for persistence across reboots. AmnesiaStealer then harvests:

• Saved passwords and keychain contents
• Chromium-based browser data (Chrome, Brave, Arc, Edge)
• Safari cookies
• Apple Notes
• Local documents

The browser session hijacking module

Beyond a credential dump, AmnesiaStealer clones the victim’s browser profile and launches it headless, establishing a live remote-control session over the Chrome DevTools Protocol — approximately 3fps screencasting with full keyboard, mouse, and tab input. The attacker operates inside an already-authenticated session without needing to crack or replay the stolen cookies.

The destruction piece

AmnesiaStealer overwrites macOS Safe Storage encryption keys after exfiltration. Chromium-based browsers use these keys to protect locally saved passwords; once overwritten, those credentials are gone from the victim’s device — not copied elsewhere, gone. Jamf identifies this as intentional malware behavior, not a side effect.

The malware also attempts to bypass macOS’s Transparency, Consent, and Control (TCC) privacy framework and uses OS version-specific branching logic to adapt across macOS releases.

What to actually do

The hook is social — someone pasted a Terminal command from a web page. This delivery method has been in wide use against macOS users since at least July, and this isn’t Jamf’s first macOS stealer find this year — CrashStealer in July used the same distribution class.

If exposure is suspected:

• Treat keychain and all Chromium-browser saved passwords as fully compromised — rotate before re-saving anything
• Saved passwords may not be recoverable from the browser if Safe Storage was overwritten; pull from a dedicated password manager if you have one
• Audit /Library/LaunchDaemons/ for unexpected entries
• Pull Jamf’s full technical analysis for IOCs before closing the investigation

For security teams: any macOS endpoint where a user ran an unexpected Terminal command in the last 48 hours is a containment priority. A separate macOS screen sharing authentication bypass is also being actively exploited today — macOS is having a rough Thursday.