AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions
AmnesiaStealer is a multi-stage Rust-based macOS information stealer distributed via ClickFix attacks using counterfeit GitHub download pages The malware employs a three-stage infection chain: shell script payload delivery, data harvesting, and on-demand interactive browser remote control It targets six Chromium-based browsers, harvests keychains, Apple Notes, documents, and attempts TCC framework bypasses including CVE-2020-9771 A unique builder-driven configuration and OS version-branched logi
Analysis
TL;DR
- AmnesiaStealer is a multi-stage Rust-based macOS information stealer distributed via ClickFix attacks using counterfeit GitHub download pages
- The malware employs a three-stage infection chain: shell script payload delivery, data harvesting, and on-demand interactive browser remote control
- It targets six Chromium-based browsers, harvests keychains, Apple Notes, documents, and attempts TCC framework bypasses including CVE-2020-9771
- A unique builder-driven configuration and OS version-branched logic allow it to use patched macOS bypasses and swap Safe Storage keys with attacker-controlled values
- The stream module uses Chrome DevTools Protocol (CDP) to launch headless browser sessions, giving attackers real-time interactive control at ~3fps
Why It Matters
This represents an escalation in macOS-targeted credential theft, combining automated data harvesting with live interactive browser hijacking — a capability previously more common in Windows malware. The use of ClickFix social engineering combined with a counterfeit GitHub page demonstrates increasingly sophisticated delivery mechanisms targeting macOS users, who may have lower security awareness than their Windows counterparts.
Technical Details
- Infection chain: A shell script fetched via a fake GitHub page executes the initial payload, which then runs the main infostealer module and a third on-demand stream module for browser control
- Data harvesting: Copies login and data-protection keychains, harvests Chromium-based browser databases (Chrome, Brave, Arc, Edge, and two others), Apple Notes, and user documents
- TCC bypass: Uses CVE-2020-9771 to attempt Safari cookie and full disk access; on macOS 26, this only works if Terminal or the malware process already has Full Disk Access granted
- Key manipulation: Overwrites per-browser Safe Storage keys in the login keychain with attacker-controlled values, accepting loss of previously saved data but enabling decryption of anything encrypted afterward
- Remote browser control: The stream module clones the victim's browser profile, launches it headless via CDP, and relays a ~3fps screencast to the attacker who can control keyboard, mouse, scroll, navigation, and tab management in real time
- Persistence: Installs a LaunchDaemon for long-term access; uses a builder-driven configuration system with OS version-branched logic
Industry Insight
- macOS security tools and monitoring should be enhanced to detect TCC bypass attempts and unauthorized headless browser processes, as current detection coverage for Mac-specific stealers remains limited compared to Windows
- The pattern of overwriting Safe Storage keys to maintain decryption capability suggests a shift toward persistent, long-term credential harvesting rather than one-time dumps — defenders should monitor for anomalous keychain modifications
- The use of ClickFix with counterfeit GitHub pages indicates attackers are exploiting developer-centric distribution channels; organizations should reinforce security awareness around Terminal command execution prompts, especially those referencing GitHub
Disclaimer: The above content is generated by AI and is for reference only.