AmnesiaStealer: macOS Infostealer that Hijacks In-Browser Sessions via ClickFix

AmnesiaStealer is a high-severity multi-stage Rust-based macOS infostealer that targets Chromium browsers. It is distributed through a fake GitHub ClickFix page that tricks users into running a shell script, which downloads and executes a password-protected ZIP file. Once installed, the malware steals login passwords, Keychain data, documents, and browser information. It also uses CDP to secretly control active browser sessions.

The malware first tricks the user into pasting a command into the Terminal via a fake GitHub page. It then downloads a shell script and executes it, saving a password-protected ZIP file to /tmp. The malware extracts the contents, adds execute permissions, applies an ad-hoc signature, and starts a Rust universal Mach-O binary.

In the second stage, the malware prompts for the macOS login password. Upon receiving it, it tries to unlock the Keychain and collects data from various sources, including Keychain, Apple Notes, Telegram, and Chromium profiles. It archives the stolen data and sends it to a command-and-control server. The malware then downloads an additional module, copies the victim's Chromium profile, and launches the real browser in headless mode with remote debugging enabled.

It controls the browser sessions using a WebSocket relay and the Chrome DevTools Protocol, exporting and importing cookies as needed.

The malware attempts to bypass security measures but fails against macOS 26 due to Full Disk Access restrictions. If it fails to obtain the Chrome Safe Storage key, it has a destructive fallback that deletes existing items and recreates them with a known password, potentially destroying access to existing saved data.

Victims may encounter a GitHub-style download page, instructions to paste a command into the Terminal, and a macOS-style password dialog. Administrators might observe curl /bash commands, /tmp files, ad-hoc signatures, LaunchDaemons, unknown C2 traffic, and headless browsers. macOS 26 users may notice abnormal activities when using the security CLI to delete and recreate Chrome Safe Storage.

For the malware to succeed, the user must run the fake command, allow download and Mach-O execution, and provide a valid stolen password. The stolen password must also be valid for creating a LaunchDaemon and accessing target browser profiles and cookies. The attacker must have a valid password to create a root LaunchDaemon, which allows persistence after reboots.

Remote control of Chromium sessions and cookie export/import are possible, but the malware may lose access to existing saved information due to the Chrome Safe Storage fallback.