New AmnesiaStealer Malware Targets macOS Users via ClickFix Attacks

A newly identified macOS infostealer, named AmnesiaStealer, targets users via ClickFix social-engineering campaigns that impersonate GitHub download pages.

This malware combines various malicious features, including password theft, browser data collection, persistence, and the hidden remote control of authenticated Chromium browser sessions.

Researchers have observed the campaign using a counterfeit GitHub-themed page that displays a “Download for macOS” prompt along with a deceptive “Verified Publisher” badge.

Rather than downloading an application directly, the site instructs victims to open Terminal, paste a command, and enter their macOS password to complete what is supposedly an installation.

This ClickFix technique shifts the execution burden onto the victim, allowing the malware to bypass the need for a conventional malicious installer.

AmnesiaStealer Malware Targets macOS Users

The copied command retrieves a shell-based Stage 0 loader from attacker-controlled infrastructure and feeds it into Bash.

The script silently downloads a password-protected ZIP archive, extracts a Rust-based universal Mach-O payload to /tmp, removes macOS quarantine attributes, applies an ad-hoc code signature, executes the payload using nohup, and clears the shell history.

The archive is password-protected with the password “dulin,” likely intended to hinder automated inspection. The loader also gives the extracted binary a hidden Apple-like filename, following the pattern `/tmp/.com.apple.dt.<digits>`, and then deletes it after execution.

Stage 1 consists of a stripped-down Rust infostealer that targets login credentials, macOS Keychain material, Apple Notes, Telegram session data, documents, browser databases, wallet-related extension data, and system profiling information.

The malware presents a native-looking “Installer” password dialog, validates the submitted password locally, and then stores it in cleartext in staging files and in `~/.pwd`.

One of AmnesiaStealer’s most notable capabilities comes from its Stage 2 component, known as stream_module. This on-demand module can remotely operate a victim’s Chromium-based browser profile. It supports various browsers, including Chrome, Brave, Microsoft Edge, Arc, Opera, Vivaldi, and Chromium.

Instead of interacting with the user’s visible browser, the module clones selected profile data into `~/.local/share/.stream/profiles/<browser>` and launches a headless instance with remote debugging enabled. It then communicates with an operator relay using WebSockets and the Chrome DevTools Protocol (CDP).

Operators can navigate pages, open or close tabs, emulate keyboard and mouse input, capture browser screens, and export cookies.

During controlled analysis, the CDP-based cookie export function successfully retrieved plaintext cookie values from the active browser session. This provides attackers with a way to abuse already authenticated accounts without needing the victim’s password again.

The malware also attempts to manipulate Chromium Safe Storage keychain entries on macOS when it cannot recover browser encryption keys. This behavior can overwrite existing browser encryption material, making saved browser data unrecoverable for the victim.

According to JamF, AmnesiaStealer seeks persistence through a root LaunchDaemon that masquerades as an Apple crash-reporting component. The observed naming pattern is `com.apple.ReportCrash.agent_<digits>.plist` located under `/Library/LaunchDaemons/`.

Security teams should investigate any Terminal-launched `curl` or `bash` execution that originates from fake software installation instructions, especially when scripts remove quarantine attributes using `xattr`, employ ad hoc code signing, or create hidden executables in `/tmp`.

Additionally, monitoring for suspicious modifications to Chrome Safe Storage entries, access to Keychain files, and unexpected headless browser instances can help identify this malicious activity.

IoC

Type	Indicator
Landing page	hxxps://github.aoitour[.]com
C2 / delivery	debug.allllowef[.]space
Related domain	news.allllowef[.]space
Related domain	shlyapadulina[.]space
Related domain	amz.shlyapadulina[.]space
IP address	138.124.70[.]84
IP address	138.124.96[.]160
Stage 1 SHA-256	de5748aac4a4d4cb48cf050652679e6bc49eda33d9ffaa0d280b578122fab55a
Stage 2 SHA-256	e853748ca8f9a5a9168263617409a9039ab09f4ffc7d860374c1e3b0b67b31a5
File artifact	/tmp/.com.apple.dt.<digits>
Persistence	/Library/LaunchDaemons/com.apple.ReportCrash.agent_<digits>.plist
Home artifact	~/.pwd

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world