Meta News

For years, macOS malware occupied a relatively narrow corner of the cybercrime ecosystem. Windows remained the dominant target for information stealers, credential theft and remote-access malware, largely because of its overwhelming presence in corporate environments. That balance has been changing as Macs have become increasingly common among developers, executives and technology professionals—users whose machines often contain credentials capable of unlocking considerably more valuable systems.

A newly discovered malware family called AmnesiaStealer illustrates how far that evolution has progressed. The Rust-based macOS information stealer does more than collect passwords and browser databases. It combines credential theft, attempts to circumvent macOS privacy protections, persistence and an on-demand remote-control capability that can give attackers interactive access to a victim’s browser session.

Security researchers at Jamf identified the malware being distributed through a counterfeit GitHub download page as part of recent ClickFix campaigns. Victims are persuaded to copy and execute a command in Terminal, initiating a multi-stage infection process that ultimately gives attackers access to a broad collection of information stored on the Mac.

The technique demonstrates an important shift in macOS threats. Attackers are no longer interested solely in stealing files or saved passwords. Increasingly, they want the authenticated sessions surrounding those credentials.

AmnesiaStealer begins with a technique that has become increasingly common across malware campaigns:ClickFix.

Rather than relying on a traditional software exploit, attackers present victims with instructions that appear to solve a technical problem or complete a legitimate installation. The victim is told to copy a command and paste it into Terminal, effectively executing the attacker’s code themselves.

In the AmnesiaStealer campaign, researchers observed a counterfeit GitHub download page being used to deliver those instructions. Once executed, a shell script retrieves and launches the malware.

This approach allows attackers to circumvent one of the strongest security boundaries on modern operating systems: preventing unknown software from executing automatically. Instead of defeating that boundary technically, the attacker persuades the user to cross it voluntarily.

The infection then progresses through three stages. An initial shell script downloads and executes the payload, AmnesiaStealer collects information from the compromised Mac, and a separate module can later be deployed to provide interactive control over browser sessions.

Once running, AmnesiaStealer begins by profiling the infected system and attempting to obtain the user’s login password. The malware validates the supplied password locally before proceeding with additional credential-access operations.

Its collection capabilities are extensive. Researchers observed the malware copying macOS login and data-protection keychains while also targeting browser databases, Apple Notes and documents stored on the machine. Six Chromium-based browsers are targeted, including Google Chrome, Microsoft Edge, Brave and Arc.

The emphasis on Keychain is particularly important. Apple’s credential storage architecture can contain passwords and secrets associated with websites, applications and services. For a developer or corporate user, those credentials may extend far beyond personal accounts to cloud services, development platforms and enterprise infrastructure.

Browser information can be equally valuable. Modern browsers have effectively become identity hubs, maintaining cookies, authenticated sessions, saved passwords and access to SaaS platforms containing enormous amounts of corporate information.

That makes stealing the browser environment potentially more valuable than stealing an individual password.

Apple’s Transparency, Consent and Control framework, commonly known as TCC, restricts access to sensitive resources such as files, cameras, microphones and other protected information. AmnesiaStealer contains functionality designed to work around some of those boundaries.

Jamf found that the malware attempts two TCC bypass techniques to gain access to Safari cookies and broader disk contents. One involves CVE-2020-9771, an older vulnerability affecting TCC protections.

The behavior differs depending on the version of macOS. On macOS 26, the technique requires Terminal or the malware process to already possess Full Disk Access, limiting its effectiveness against fully protected systems.

That conditional behavior is noteworthy because it demonstrates that the malware has been designed with awareness of differences between macOS versions. Rather than assuming the same attack path will work everywhere, it adjusts its behavior according to the environment it encounters.

Jamf describes this version-dependent logic as one of the characteristics distinguishing AmnesiaStealer from established macOS infostealer families such as Atomic Stealer, MacSync and CrashStealer.

The most technically interesting aspect of AmnesiaStealer appears after the initial information theft.

If the malware receives aremote_streamcommand from its command-and-control infrastructure, it downloads an additional component capable of cloning the victim’s browser profile and launching a headless browser instance.

The attacker can then interact with that environment remotely.

Using the Chrome DevTools Protocol (CDP), the module establishes a relay through which the operator receives a live representation of the browser session and can send keyboard, mouse, scrolling, navigation and tab-management commands.

Jamf observed the stream operating at roughly three frames per second. Researchers emphasized that this is not simply an automated browser data dump; it effectively provides a hidden, interactive browser session controlled by the attacker.

That distinction matters because authenticated browser sessions have become one of the most valuable assets in modern cybercrime.

Multi-factor authentication has significantly improved account security by making stolen passwords less useful. An attacker who possesses a username and password may still be unable to authenticate without the victim’s second factor.

Session hijacking attacks attempt to bypass that problem by targeting what happens after authentication.

Once a user successfully signs into an application, the service generally issues a session cookie or token indicating that authentication has already occurred. The browser continues presenting that token during subsequent requests so the user does not need to enter a password and complete MFA every few seconds.

If attackers can take control of an authenticated browser environment, they may not need to defeat MFA directly. They can attempt to operate inside a session where the authentication process has already been completed.

AmnesiaStealer’s remote browser functionality therefore represents a more consequential capability than conventional password harvesting. The attacker is potentially inheriting the victim’s digital context rather than simply collecting credentials for later use.

For corporate users, that browser might already be authenticated to email, source-code repositories, collaboration platforms, cloud consoles, CRM systems or internal applications.

AmnesiaStealer also performs an unusual operation against Chromium-based browsers. Researchers observed it overwriting the browser-specific Safe Storage key contained within the macOS login keychain with a value controlled by the attacker.

The consequence is destructive: previously stored passwords and cookies encrypted with the original key can become unrecoverable.

But the attackers appear willing to accept that loss.

On macOS 26, where retrieving the existing key may prove difficult, replacing it gives the operator knowledge of the key that will protect information stored afterward. Future encrypted data can consequently become accessible to the attacker.

The technique reveals something about the malware’s priorities. Preserving the victim’s existing browser environment is less important than establishing control over what comes next.

This moves AmnesiaStealer beyond a conventional grab-and-run infostealer toward malware designed to maintain an ongoing relationship with the compromised browser.

After collecting information, AmnesiaStealer archives the stolen material and sends it to its command-and-control infrastructure. It also installs a LaunchDaemon, providing persistence across the system.

Persistence significantly changes the incident-response implications. Removing an obvious malicious download or closing the Terminal window does not necessarily end the compromise. The malware has attempted to establish itself as a continuing presence on the Mac.

For defenders, an infection therefore needs to be treated as a broader credential and session compromise rather than merely a malicious file requiring deletion.

Passwords accessible from the machine may need to be changed, active sessions revoked and authentication tokens invalidated. Depending on the victim’s role, cloud credentials, development secrets and other sensitive identities stored locally may also require rotation.

The growth of sophisticated macOS stealers is closely connected to the changing demographics of valuable endpoints.

Macs are heavily represented among software engineers, startup employees, security researchers and technology executives. These users frequently maintain access to precisely the infrastructure cybercriminals want to reach.

A developer’s Mac may contain Git credentials, SSH keys, cloud authentication, API tokens, package registry credentials and access to production systems. Browser sessions may simultaneously provide authenticated access to GitHub, Slack, cloud dashboards and administrative applications.

Compromising one high-value workstation can therefore provide a pathway into a much larger organization.

This economic incentive helps explain why macOS increasingly attracts malware development comparable to techniques traditionally associated with Windows information stealers.

AmnesiaStealer is written in Rust, continuing a broader trend toward malware developed using modern cross-platform programming languages.

Rust offers performance, memory safety and a growing ecosystem of libraries, qualities that have made it popular among legitimate developers. Many of those same characteristics are attractive to malware authors.

The choice of language is less important than the broader trend it represents: macOS malware development is becoming increasingly professionalized.

Attackers are creating configurable families, modular payloads and specialized second-stage capabilities rather than relying exclusively on simple scripts designed to collect a handful of files.

AmnesiaStealer’s builder-driven configuration and optional remote-control component suggest an architecture intended to support different campaigns and objectives.

Apple has constructed multiple layers of protection around macOS, including application signing, Gatekeeper, sandboxing, TCC permissions and increasingly restrictive access to sensitive data.

AmnesiaStealer demonstrates the persistent challenge faced by all of these technologies: security controls become considerably less effective when users are persuaded to authorize the attack themselves.

ClickFix is successful precisely because it moves the malicious action into a trusted context. Terminal is legitimate. The user intentionally opens it. The user pastes the command. The operating system therefore sees behavior that superficially resembles ordinary administration.

Security awareness consequently needs to evolve alongside endpoint defenses. Instructions telling users to paste unfamiliar commands into Terminal should be treated with the same suspicion traditionally reserved for unexpected executable attachments.

For enterprises managing Macs, limiting administrative privileges, monitoring unusual shell activity and controlling Full Disk Access permissions can further reduce the impact of this class of threat.

The most important lesson from AmnesiaStealer may ultimately concern the changing role of the browser.

For many employees, the browser has effectively become the operating system for work. Email, source control, document collaboration, finance, HR, customer management and cloud administration increasingly live inside web applications.

That concentration has made authenticated browser sessions extraordinarily valuable.

AmnesiaStealer reflects this transition. It steals traditional information, but its most distinctive capability is the ability to create a remotely controlled copy of the victim’s browser environment and allow an attacker to operate it interactively.

This is where modern identity security becomes considerably more complicated. Strong passwords and MFA remain essential, but neither provides complete protection when attackers can operate from within an already authenticated session.

Defenders increasingly need mechanisms capable of recognizing when legitimate credentials, cookies and sessions begin behaving in illegitimate ways.

AmnesiaStealer therefore represents more than another entry in the growing catalog of macOS malware. It illustrates where information-stealing malware is heading: away from simply collecting passwords and toward capturing the authenticated digital environment surrounding the user.

As more corporate work moves into browsers and more high-value professionals adopt Macs, that environment will only become more attractive to attackers.