A new malware targeting macOS called AmnesiaStealer enables attackers to steal data and silently assume control of already authenticated browser sessions. The threat combines infostealer capabilities, persistence techniques, and active session hijacking.
The infection begins with a fake page mimicking GitHub that instructs the victim to copy a command into the Terminal. This ClickFix technique tricks the user into initiating the malicious chain themselves. After execution, the malware installs a payload written in Rust, gathers information from the Mac, and shows a fake installer window to capture the user password.
With the obtained password, it attempts to unlock the Keychain and access protected information. Targeted data includes credentials, cookies, browsing history, extensions, documents, Apple Notes, Telegram sessions, and details related to cryptocurrency wallets.
Advanced Browser Hijacking Module
The most sophisticated feature is a secondary module that copies the browser profile and starts a hidden Chromium session. Through the Chrome DevTools Protocol, attackers can open pages, control tabs, and send keyboard and mouse commands. This mechanism allows them to leverage sessions that have already completed multi-factor authentication.
In some cases, the attacker can access accounts without re-entering passwords or MFA codes as long as the session remains valid. AmnesiaStealer also establishes persistence using a disguised LaunchDaemon, ensuring the compromise survives the initial execution. The malware further attempts to erase artifacts used during installation.
