AmnesiaStealer macOS Malware Gives Hackers Remote Control of Browser Sessions
A new information-stealing malware called AmnesiaStealer targets macOS users through ClickFix attacks and includes a streaming module that lets attackers interactively control a victim's web browser. One of its most notable capabilities is copying the victim's Chromium browser profile, including its authentication state, and loading it into a hidden, headless browser on the infected system. This allows the attacker to access the victim's authenticated sessions while preserving the identifiers associated with the browser, host, and network, making the activity appear legitimate.
Researchers at Jamf, an Apple device management and security company, analyze the malware's distribution and find it uses the same template previously employed to spread the Atomic and MacSync infostealers. The campaign uses a fake GitHub download page to deliver a password-protected ZIP archive containing the AmnesiaStealer Mach-O payload. Once installed, the malware captures the victim's macOS password and uses it to collect keychain data, browser profiles, Apple Notes, Telegram sessions, documents, system information, and cryptocurrency wallet data across 16 Chromium-based browsers.
The researchers highlight a component called stream_module, retrieved using the remote_stream command, which gives the operator remote control over authenticated sessions through a headless browser instance. The module duplicates user profiles in seven Chromium-based browsers, including Chrome, Edge, Vivaldi, Arc, Opera, Brave, and Chromium, because they share the same DevTools Protocol, launch flags, and cookie encryption. It launches the legitimate browser executable in headless mode with command-line switches that weaken browser defenses, then establishes a WebSocket channel connecting to the operator's relay, giving the attacker live access to the victim's logged-in accounts.