AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions

1. Executive summary

Jamf Threat Labs has disclosed AmnesiaStealer, a Rust-based macOS infostealer distributed via a counterfeit GitHub download page using ClickFix social-engineering lures. The malware executes a three-stage infection chain that harvests passwords, keychain data, Chromium-based browser databases, Apple Notes, and documents, and includes an interactive remote-control module that clones browser profiles and relays live browser sessions to the operator via the Chrome DevTools Protocol. AmnesiaStealer attempts TCC framework bypasses (including CVE-2020-9771) for Safari cookie and Full Disk Access, overwrites per-browser Safe Storage keys with attacker-controlled values, and installs a LaunchDaemon for persistence. EMEA financial services firms with macOS-equipped workforces — particularly those allowing developer or analyst workstations with Terminal access — face credential theft, session hijacking, and potential downstream access to authenticated banking and internal applications.

2. Regulatory framing

3. Technical analysis & attack chain

Attribution caveat: No MITRE ATT&CK actor profile has been resolved for this item. Attribution to any named threat actor is unconfirmed. Jamf Threat Labs is the sole primary source for the technical analysis below; all claims rest on this single vendor report.

Attack chain (confirmed from source)

1. Initial access — ClickFix lure: The victim is directed to a counterfeit GitHub download page. The social-engineering technique ("ClickFix") tricks the user into copying and pasting a command into macOS Terminal.
2. Stage 1 — Shell script execution: The pasted Terminal command runs a shell script that fetches and executes the payload from a remote server.
3. Stage 2 — AmnesiaStealer payload (Rust-based): The core infostealer executes and performs the following: - Reconnaissance: Gathers OS version information; the malware branches its logic based on the detected macOS version, reaching for patched bypasses where applicable. - Credential harvesting: Prompts the user to enter their login password and validates it locally. - Keychain theft: Copies the login keychain and data-protection keychain. - Browser data theft: Harvests databases from six Chromium-based browsers — Chrome, Brave, Arc, and Edge are named; two others are unspecified. Overwrites the per-browser Safe Storage key in the login keychain with an attacker-controlled value, rendering previously saved passwords and cookies unrecoverable. On macOS 26, the malware accepts the loss of the existing key and swaps it for one the operator controls, ensuring future encrypted data is decryptable operator-side. - Additional data theft: Harvests Apple Notes and documents. - TCC bypass attempts: Attempts two Transparency, Consent, and Control (TCC) framework bypasses to gain Safari cookie access and Full Disk Access. One bypass leverages CVE-2020-9771, an old TCC vulnerability. On macOS 26, the CVE-2020-9771 attack works only if Terminal or the malware process already has Full Disk Access. - Data exfiltration: Archives all harvested data and transmits it to a command-and-control (C&C) server. - Persistence: Installs a LaunchDaemon for persistence across reboots.
4. Stage 3 — Stream module (on-demand): Upon receiving a remote_stream command from the C&C, the malware downloads and executes a stream module that: - Clones the victim's browser profile. - Launches a headless copy of the browser. - Uses the Chrome DevTools Protocol (CDP) to create a relay channel for interactive attacker control. - Streams a live screencast of the session to the operator at approximately 3 fps. - Provides the operator with full input control: keyboard, mouse, scroll, navigation, and tab management — all translated into CDP calls against the headless browser in real time.

Key technical distinctions noted by Jamf

• Builder-driven configuration (customisable per-build).
• OS version-branched logic targeting patched macOS bypasses.
• Remote-control second stage (interactive, not automated).

Overlap: Jamf notes objectives overlap with Atomic (AMOS), MacSync, and CrashStealer families.

4. Mitigation & containment

P1 — Within 24 hours

• Block Terminal execution for non-developer users: Deploy a configuration profile restricting Terminal access to approved user groups via MDM. This directly disrupts the ClickFix paste-to-Terminal initial access vector.
• Hunt for LaunchDaemon persistence: Inspect /Library/LaunchDaemons/ and ~/Library/LaunchAgents/ for newly created or unrecognised plist files. Quarantine any unsigned or unrecognised entries.
• Audit Full Disk Access grants: Review which applications and users hold Full Disk Access in System Settings > Privacy & Security. Revoke FDA from Terminal and any non-essential processes. On macOS 26, the CVE-2020-9771 bypass requires pre-existing FDA — removing it neutralises that path.
• Review browser Safe Storage keys: Check login keychain for modified Safe Storage entries (Chrome Safe Storage, Brave Safe Storage, Microsoft Edge Safe Storage, etc.). If keys have been replaced, assume all saved credentials and cookies are compromised.

P2 — Within 72 hours

• Deploy EDR detection content: Deploy the YARA and Sigma rules in §6 to endpoint detection tooling. Focus detection on: shell scripts fetching remote payloads, browser profile cloning activity, headless browser launches with CDP flags, and keychain access by non-browser processes.
• Network controls: Block known C&C infrastructure if IOCs become available. Monitor egress for large archive uploads from macOS endpoints following suspicious Terminal activity.
• Credential reset workflow: For any confirmed or suspected infection: revoke all saved browser credentials, rotate the user's login password, rotate keychain passwords, invalidate active browser sessions (force re-authentication on SaaS and internal applications), and review authentication logs for anomalous session activity originating from the compromised host.
• Patch verification: Confirm all macOS endpoints are patched against CVE-2020-9771. Note: Jamf indicates the bypass is still functional on older macOS versions; on macOS 26 it requires pre-existing FDA.

P3 — Within 7 days

• Developer awareness briefing: Communicate the counterfeit GitHub download page tactic to development teams. Reinforce verification of repository authenticity and prohibit execution of pasted Terminal commands from untrusted sources.
• MDM policy hardening: Deploy managed preferences restricting the execution of unsigned applications and scripts. Consider enabling Gatekeeper enforcement and restricting AppleScript execution where feasible.
• Threat hunt for stream module: Search for evidence of headless browser processes (e.g., --headless, --remote-debugging-port flags) in process logs, which would indicate the Stage 3 stream module has been activated. Any such finding indicates active interactive session hijacking and requires immediate incident response.

5. Indicators of compromise

No atomic indicators of compromise (hashes, domains, IPs, URLs) are available in the source material.

Behavioural indicators

6. Detection

rule AmnesiaStealer_macOS_Infostealer {
    meta:
        author = "Adverse Trace"
        date = "2026-08-14"
        reference = "https://www.securityweek.com/amnesiastealer-macos-malware-steals-data-controls-browser-sessions/"
        description = "Detects AmnesiaStealer macOS infostealer based on reported artefacts and behaviours"
    strings:
        $cmd_remote_stream = "remote_stream" ascii
        $keychain_login = "login.keychain" ascii
        $keychain_dp = "data-protection" ascii
        $safe_storage = "Safe Storage" ascii
        $cdp_flag = "--remote-debugging-port" ascii
        $headless = "--headless" ascii
        $launchdaemon = "LaunchDaemon" ascii
        $apple_notes = "Apple Notes" ascii
        $tcc_db = "TCC.db" ascii
    condition:
        4 of them
}

title: AmnesiaStealer macOS - Headless Browser Launch with CDP Flags
id: 7a3c1f2e-4b5d-4a8e-9c1f-0a6b2c3d4e5f
status: experimental
description: Detects headless browser launches with Chrome DevTools Protocol flags, consistent with AmnesiaStealer stream module
author: Adverse Trace
date: 2026/08/14
references:

    - https://www.securityweek.com/amnesiastealer-macos-malware-steals-data-controls-browser-sessions/
logsource:
    product: macos
    category: process_creation
detection:
    selection:
        CommandLine|contains:

            - '--headless'
            - '--remote-debugging-port'
    condition: selection
falsepositives:

    - Legitimate automated testing or CI/CD browser automation
level: high

title: AmnesiaStealer macOS - Keychain Access by Non-Browser Process
id: 8b4d2g3f-5c6e-4b9f-0d2g-1b7c3d4e5f6a
status: experimental
description: Detects non-browser processes accessing keychain files, consistent with AmnesiaStealer credential theft
author: Adverse Trace
date: 2026/08/14
references:

    - https://www.securityweek.com/amnesiastealer-macos-malware-steals-data-controls-browser-sessions/
logsource:
    product: macos
    category: file_access
detection:
    selection:
        TargetFilename|contains:

            - 'login.keychain'
            - 'data-protection'
    filter_legitimate:
        Image|contains:

            - '/System/Library/'
            - 'SecurityAgent'
            - 'keychainaccess'
    condition: selection and not filter_legitimate
falsepositives:

    - Legitimate keychain management tools
    - MDM agents performing keychain operations
level: high

title: AmnesiaStealer macOS - LaunchDaemon Creation by Non-System Process
id: 9c5e3h4g-6d7f-4c0a-1e3h-2c8d4e5f6a7b
status: experimental
description: Detects creation of LaunchDaemon plists by non-system processes, consistent with AmnesiaStealer persistence
author: Adverse Trace
date: 2026/08/14
references:

    - https://www.securityweek.com/amnesiastealer-macos-malware-steals-data-controls-browser-sessions/
logsource:
    product: macos
    category: file_creation
detection:
    selection:
        TargetFilename|contains:

            - '/Library/LaunchDaemons/'
            - '/Library/LaunchAgents/'
    filter_system:
        Image|startswith:

            - '/usr/libexec/'
            - '/System/Library/'
    condition: selection and not filter_system
falsepositives:

    - Legitimate software installers creating LaunchDaemons
    - MDM agent deployment
level: medium

7. Sources

• SecurityWeek — "AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions" — https://www.securityweek.com/amnesiastealer-macos-malware-steals-data-controls-browser-sessions/ — 2026-08-14
• Help Net Security — "New macOS malware steals passwords by posing as Apple's crash-reporting tool" — https://www.helpnetsecurity.com/2026/07/14/crashstealer-macos-infostealer-password-theft/ — 2026-07-14 (related context on CrashStealer family overlap)
• The Hacker News — "PamStealer Uses Fake Maccy Sites and PAM Checks to Steal Mac Login Passwords" — https://thehackernews.com/2026/07/pamstealer-uses-fake-maccy-sites-and.html — 2026-07 (related context on macOS stealer landscape)

8. Adverse Trace position

AmnesiaStealer represents a notable escalation in macOS infostealer capability due to its interactive browser-session control module — the CDP-based stream module transforms this from a one-time data theft tool into a persistent remote-access platform that can drive authenticated browser sessions against banking portals, internal applications, and SaaS platforms. The ClickFix distribution vector (social-engineering users into pasting Terminal commands) remains effective against developer and technical-user populations common in financial services. The Safe Storage key overwrite is particularly damaging: even if the infection is detected and remediated, previously saved credentials are permanently lost and must be treated as compromised. All technical claims in this advisory are single-sourced to Jamf Threat Labs; we assess the reporting as credible given Jamf's track record on macOS threats but recommend clients verify IOCs before enforcement once atomic indicators are published. We will update this advisory if C&C infrastructure, file hashes, or additional TTPs are disclosed.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.