AmnesiaStealer: Rust-Based macOS Stealer Hijacks Browser Sessions via ClickFix

A sophisticated Rust-based macOS information stealer dubbed AmnesiaStealer is being distributed through counterfeit GitHub download pages in active ClickFix social engineering campaigns. According to Jamf Threat Labs, victims are lured into pasting a malicious command into Terminal, which kicks off a three-stage infection chain: a shell script fetches and executes the primary payload, the stealer harvests sensitive data, and a third on-demand module establishes interactive remote control over the victim's browser session.

Once deployed, AmnesiaStealer performs host reconnaissance, prompts the user for their macOS login password and validates it locally, then exfiltrates login and data-protection keychains, Chromium-based browser databases, Apple Notes, and user documents. The malware attempts two Transparency, Consent, and Control (TCC) framework bypasses to access Safari cookies and gain full disk access, archives the stolen data, transmits it to a command-and-control server, and installs a LaunchDaemon for persistence. It targets six Chromium-based browsers, including Chrome, Brave, Arc, and Edge, and notably overwrites each browser's Safe Storage key in the login keychain with an attacker-controlled value, permanently encrypting previously saved passwords and cookies and rendering them unrecoverable. Operators exploit the legacy CVE-2020-9771 TCC bypass for Safari cookie theft and TCC database access, though on macOS 26 the attack only succeeds if Terminal or the malware process already holds Full Disk Access.

The final stage is a stream module executed only when the attacker issues a remote_stream command. It clones the victim's browser profile and launches it headless via the Chrome DevTools Protocol (CDP), creating a live relay channel that delivers a roughly 3fps screencast to the operator while supporting full keyboard, mouse, scroll, navigation, and tab management inputs translated in real time into CDP calls. Jamf researchers describe this as a "hands-on-keyboard hidden browser session" rather than an automated dump. Overwriting the Safe Storage key is a deliberate trade-off: the operator cannot recover existing credentials on macOS 26, so they substitute a known key and re-encrypt new data on the victim's machine for offline decryption. Given the credential theft and profile-cloning capabilities involved, users should verify whether their accounts have been exposed using an email breach checker, audit their browser fingerprint exposure with a browser fingerprint test, and confirm stored credentials are not compromised via a password checker.