AmnesiaStealer Gives Hackers Hidden Control of Logged-In Browsers on Macs

AmnesiaStealer is a newly identified macOS information stealer that does more than copy saved passwords. It can give criminals quiet control of a browser that is already signed in, turning an infected Mac into a gateway to email, business apps, cryptocurrency services, and other accounts without alerting the user.

The campaign uses ClickFix, a social-engineering trick that persuades people to run a command themselves.

Victims are sent to a counterfeit GitHub download page, then told to copy a command into Terminal. That command downloads and starts a multi-stage Rust-based payload while removing installation traces.

Polyswarm said in a report shared with Cyber Security News (CSN) that the malware gathers credentials, browser records, Apple Notes, Telegram session data, documents, wallet-related browser data, and keychain material.

Analysts at Polyswarm identified the threat as a shift from simple data theft toward hands-on abuse of authenticated browser sessions.

The risk is especially serious because a stolen password can often be reset, while an active browser session may already satisfy multi-factor authentication.

The campaign also establishes a disguised LaunchDaemon for persistence, making a one-time unsafe Terminal command capable of creating a longer-lived compromise.

AmnesiaStealer Gives Hackers Hidden Control

AmnesiaStealer’s defining feature is its second-stage browser streaming module. After the initial collection phase, operators can request a component that copies the victim’s browser profile and opens it in a hidden, headless Chromium session.

The victim’s normal browser remains visible and may show no obvious sign of misuse. The module communicates through the Chrome DevTools Protocol, a legitimate browser interface intended for debugging.

In the wrong hands, it lets an operator navigate sites, open and manage tabs, send keyboard and mouse actions, and view browser output in real time. It supports seven Chromium-family browsers.

That access changes the practical value of an infection. Instead of sorting through exported data later, an attacker can act while a session is valid, including viewing account pages, moving through sign-in flows, exporting decrypted cookies, or importing cookies into another session.

The same broad danger is reflected in macOS credential theft threats, where stolen browser data can enable account takeover. Stage one targets sixteen Chromium-family browsers, collecting cookies, login databases, history, bookmarks, extensions, Local State, Preferences, and related artifacts.

It also tries to obtain each browser’s Safe Storage key from the login keychain, potentially helping the later module read protected browser information.

The operation is built to vary by campaign and macOS version. Researchers noted encrypted, build-specific settings and execution paths, alongside older collection and privacy-control bypass attempts that Apple has already addressed. That flexibility makes behavioral clues, rather than a single file signature, important for defenders.

ClickFix Lure Raises the Stakes

The initial lure relies on trust rather than a software vulnerability. A fake download page imitates a familiar developer site and replaces a normal installer with instructions to run Terminal code.

Related macOS ClickFix attack reports show how attackers exploit routine verification and download prompts to get users to start malware themselves.

Once executed, AmnesiaStealer profiles the Mac and displays an Installer-themed prompt for the user’s password.

It verifies that password locally, unlocks the login keychain, packages stolen material, and sends it to attacker-controlled infrastructure before setting up its persistence mechanism and cleaning up artifacts.

Users should treat any webpage directing them to paste commands into Terminal as suspicious, even when it appears to be GitHub, a CAPTCHA, or a support page.

Recent macOS utility lure campaigns used similar instructions, demonstrating why an apparent fix should be independently verified through an official vendor channel.

Security teams should watch for unexpected Terminal activity, unusual keychain access, browser-profile copying, hidden Chromium launches, and new LaunchDaemons that resemble Apple components.

These patterns offer more durable detection than a filename alone. Monitoring cross-platform ClickFix delivery chains can also help teams recognize the social-engineering sequence before theft begins.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post AmnesiaStealer Gives Hackers Hidden Control of Logged-In Browsers on Macs appeared first on Cyber Security News.