New macOS Malware Clones Your Logged-In Browser and Gives Hackers Remote Control.

AmnesiaStealer, a multi-stage macOS infostealer written in Rust that moves beyond conventional credential theft by giving attackers covert, interactive control over a victim’s authenticated Chromium browser sessions.

The malware is being distributed through a ClickFix social-engineering campaign that directs users to counterfeit GitHub download pages.

Instead of delivering a legitimate application, the sites instruct visitors to copy and execute a command in Terminal.

That command launches a shell-based infection chain that downloads, extracts, signs and executes the malware before deleting installer artifacts to limit forensic traces.

However, its most consequential feature is a dedicated browser-streaming component that clones a logged-in browser profile and exposes it to remote operators through the Chrome DevTools Protocol (CDP).

Jamf’s analysis describes the campaign as a significant evolution in macOS infostealer tradecraft.

Traditional infostealers typically copy browser databases, cookies, saved passwords and autofill records for later offline processing. AmnesiaStealer uses that collection phase as a stepping stone.

Its Stage 1 payload targets 16 Chromium-family browsers and attempts to obtain cookies, login databases, history, bookmarks, extension data, Local State files and browser preferences.

It also seeks browser Safe Storage keys from the victim’s macOS login keychain, potentially enabling decryption of protected browser artifacts.

When instructed by its operator, the malware downloads a Stage 2 streaming module supporting seven Chromium-based browsers.

The module creates a cloned profile, launches it in a hidden headless browser instance and enables remote interaction through CDP.

This gives attackers the ability to browse sites using the victim’s existing sessions, open and manage tabs, simulate mouse and keyboard input, observe browser output, export plaintext cookies and import cookies into other browser sessions.

Jamf researchers said AmnesiaStealer, can harvest credentials, browser data, Apple Notes, Telegram session information, documents, wallet-related browser artifacts, and macOS Keychain contents.

The attacker does not need to visibly take over the victim’s desktop or disrupt the browser window already in use.

The technique is especially dangerous for users authenticated to corporate SaaS platforms, email, cloud consoles, cryptocurrency services, developer portals and financial accounts.

Logged-In Session Theft

A stolen password may trigger MFA, but an active browser session can allow an adversary to bypass that friction until the session is revoked or expires.

AmnesiaStealer begins by profiling the compromised host and displaying a native Installer-style password prompt.

The supplied password is validated locally and used to unlock the login keychain, allowing the malware to access sensitive credentials and encryption material.

Collected information is staged and archived before being sent to attacker-controlled infrastructure. The malware then establishes persistence through a LaunchDaemon disguised as an Apple crash-reporting component.

It removes selected files and installation artifacts afterward, reducing the evidence available to incident responders.

Researchers also identified builder-generated configurations containing encrypted campaign settings, build identifiers, configurable infrastructure and macOS version-aware execution paths.

This design allows operators to produce changing variants without altering the larger collection and browser-abuse workflow.

AmnesiaStealer shares broad objectives with macOS threats such as Atomic Stealer, MacSync and CrashStealer. It also uses a counterfeit GitHub lure pattern previously seen in Atomic and MacSync campaigns.

But its dedicated browser-streaming function marks a meaningful departure: the browser is no longer merely a repository of stolen data; it becomes a remotely operated foothold.

Defenders should prioritize behavioral detections over static indicators because builder-driven malware can rapidly rotate hashes, filenames and hosting infrastructure.

Security teams should investigate Terminal activity triggered after visits to software-download pages, unexpected use of curl or shell download commands, abnormal login-keychain access, and new LaunchDaemon entries masquerading as Apple components.

Hidden Chromium execution, unexpected browser-profile duplication and Chrome DevTools Protocol connections from unusual processes also warrant immediate review.

Users should avoid executing Terminal commands supplied by websites, social-media posts or supposed GitHub download pages.

Organizations can further reduce exposure by enforcing application controls, monitoring persistence locations and rapidly revoking browser sessions when macOS credential theft is suspected.

AmnesiaStealer demonstrates a growing reality for macOS defense: protecting passwords is no longer enough. Defenders must also protect the authenticated browser sessions that increasingly function as the gateway to a user’s digital identity.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide