{
  "id": 952363,
  "title": "AmnesiaStealer: macOS Infostealer that Hijacks In-Browser Sessions via ClickFix",
  "url": "https://urgent.news/2026/08/15/amnesiastealer-macos-infostealer-that-hijacks-in-browser-sessions-via",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-15T04:22:37.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/anoymask/amnesiastealer-macos-infostealer-that-hijacks-in-browser-sessions-via-clickfix-13fg"
  },
  "original_language": "en",
  "account": "AmnesiaStealer is a high-severity multi-stage Rust-based macOS infostealer that targets Chromium browsers. It is distributed through a fake GitHub ClickFix page that tricks users into running a shell script, which downloads and executes a password-protected ZIP file. Once installed, the malware steals login passwords, Keychain data, documents, and browser information. It also uses CDP to secretly control active browser sessions.\n\nThe malware first tricks the user into pasting a command into the Terminal via a fake GitHub page. It then downloads a shell script and executes it, saving a password-protected ZIP file to /tmp. The malware extracts the contents, adds execute permissions, applies an ad-hoc signature, and starts a Rust universal Mach-O binary.\n\nIn the second stage, the malware prompts for the macOS login password. Upon receiving it, it tries to unlock the Keychain and collects data from various sources, including Keychain, Apple Notes, Telegram, and Chromium profiles. It archives the stolen data and sends it to a command-and-control server. The malware then downloads an additional module, copies the victim's Chromium profile, and launches the real browser in headless mode with remote debugging enabled. It controls the browser sessions using a WebSocket relay and the Chrome DevTools Protocol, exporting and importing cookies as needed.\n\nThe malware attempts to bypass security measures but fails against macOS 26 due to Full Disk Access restrictions. If it fails to obtain the Chrome Safe Storage key, it has a destructive fallback that deletes existing items and recreates them with a known password, potentially destroying access to existing saved data.\n\nVictims may encounter a GitHub-style download page, instructions to paste a command into the Terminal, and a macOS-style password dialog. Administrators might observe curl /bash commands, /tmp files, ad-hoc signatures, LaunchDaemons, unknown C2 traffic, and headless browsers. macOS 26 users may notice abnormal activities when using the security CLI to delete and recreate Chrome Safe Storage.\n\nFor the malware to succeed, the user must run the fake command, allow download and Mach-O execution, and provide a valid stolen password. The stolen password must also be valid for creating a LaunchDaemon and accessing target browser profiles and cookies. The attacker must have a valid password to create a root LaunchDaemon, which allows persistence after reboots. Remote control of Chromium sessions and cookie export/import are possible, but the malware may lose access to existing saved information due to the Chrome Safe Storage fallback.",
  "summary": "AmnesiaStealer: macOS Infostealer that Hijacks In-Browser Sessions via ClickFix 1. Basic Information Severity: High Article Title: AmnesiaStealer: a multi-stage Rust-based macOS infostealer that hijacks Chromium browsers Publisher: Jamf Threat Labs Publication Date: 2026-08-13 Update Date: N/A Original Source: Original Related Sources: SecurityWeek Malware: AmnesiaStealer, stream_module Groups:…",
  "key_points": [
    "AmnesiaStealer is macOS-specific infostealer targeting Chromium browsers",
    "Distributed via fake GitHub ClickFix page tricking users into executing shell script",
    "Steals login passwords, Keychain data, documents, browser info using CDP control"
  ],
  "editors_take": "This malware development shows attackers can now hijack in-browser sessions on macOS systems, posing a significant threat to users who fall for the initial deception and provide their login credentials.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}