AmnesiaStealer Hijacks macOS Browser Sessions

New macOS infostealer confirmed active. Jamf researchers disclosed AmnesiaStealer today — a ClickFix-delivered payload that goes beyond credential harvesting and hands attackers a live, interactive browser session on the victim’s machine.

Delivery

Distribution: ClickFix campaigns using fake GitHub download pages. Lure: a password-protected ZIP archive. Loader: a shell script that fetches and executes the main payload. ClickFix is social engineering, not a software exploit — it instructs users to paste and run attacker-supplied terminal commands to “install” what appears to be a legitimate download. No CVE. No patch. The attack surface is the user.

What it steals

Standard infostealer scope: credentials from 16 Chromium-based browsers (Chrome, Edge, Arc, Brave, Vivaldi, Opera, Chromium, and others), Apple Notes, local documents, cryptocurrency wallet data, keychain contents, and the macOS admin password captured during execution.

The stream module

The distinguishing capability: AmnesiaStealer includes a streaming module that duplicates the victim’s browser profile in headless mode and establishes a WebSocket connection to an operator relay. Attackers receive a live screencast at approximately 3fps with full keyboard, mouse, and navigation control.

Practical impact: authenticated sessions — corporate SSO, banking, webmail — remain live inside the hijacked headless profile. Operators can interact directly without needing to extract and replay session tokens. The stolen credentials become secondary; the active session is the primary target.

Attribution and lineage

Jamf identified template overlap with Atomic Stealer and MacSync infostealer code — shared builder or codebase, likely. Specific threat actor attribution: unconfirmed.

This follows a pattern Jamf documented with PamStealer in July — macOS infostealers iterating quickly, borrowing code, adding credential-extraction primitives with each generation.

Mitigation

No software patch applies. Defense posture:

• Users: Don’t execute terminal commands from instructions found online unless you understand exactly what they do. Legitimate software installers don’t require this.
• Enterprise macOS fleets: Enforce MDM behavioral policies (Jamf Pro or equivalent) with alerts on unexpected process spawning.
• EDR: Flag headless Chromium process execution and Chrome Safe Storage key access outside expected parent processes.
• Incident response: If compromise is suspected, assume all saved browser credentials and active sessions are compromised. Rotate passwords and revoke active sessions across all services accessed from that machine.