AmnesiaStealer malware targets macOS users via browser hijacking

A new macOS-targeted information-stealing malware named AmnesiaStealer has been identified by researchers at Jamf. The malware utilizes ClickFix campaigns, which employ fake GitHub download pages to trick users into executing malicious commands via a terminal installation lure.

AmnesiaStealer is notable for its ability to hijack browser sessions. Through a component called the ‘stream_module’, attackers can gain interactive remote control over a victim’s web browser. The malware can copy Chromium profiles, including authentication states, and load them into a hidden, headless browser. This allows hackers to access authenticated sessions while maintaining the identifiers associated with the host, network, and specific browser.

The malware is written in Rust and can target 16 different Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, and Opera. In addition to browser data, AmnesiaStealer is capable of collecting passwords, cryptocurrency wallets, Apple Notes, documents, Telegram sessions, and keychain data by capturing the victim’s macOS password.