AmnesiaStealer Turns the macOS Browser into a Remotely Controlled Session

A Fake GitHub Page Tricks Victims into Using Terminal

On August 14, 2026, Jamf Threat Labs reported AmnesiaStealer, a new Rust-based infostealer designed to target macOS users.

The observed distribution campaign uses counterfeit GitHub pages. The sites replicate the platform’s dark theme, display the Octocat logo, and even include a “Verified Publisher” badge. However, instead of a download button, they instruct users to copy and paste a command into Terminal.

This is the ClickFix technique, which abuses user interaction rather than relying on a conventional download. The command launches a shell script that downloads and executes the payload.

Similar pages have also been linked to campaigns associated with Atomic Stealer and MacSync. This suggests that multiple malware families may be reusing infrastructure and social-engineering templates.

The exact compatible macOS and browser versions have not been disclosed. However, the analysis indicates behavior specific to macOS 26.

Three Components, from Infection to Browser Control

The infection chain consists of three stages. The first is a shell script that retrieves and launches the malware. The second is the Rust infostealer, which collects system information. The third is stream_module, downloaded when needed.

This module adds the threat’s most dangerous capability: the remote_stream command. It does more than extract cookies or passwords—it creates a browser session that the operator can control in real time.

To do this, AmnesiaStealer clones the browser profile and launches a headless session. The attacker can then send keyboard input, click the mouse, browse the web, and manage open tabs. The activity takes place in a separate, hidden window.

The browser window normally used by the victim remains unchanged. The user can therefore continue viewing their own session without realizing that another instance is operating on the same profile.

The module uses the Chrome DevTools Protocol and calls Network.getAllCookies on the headless session. By that point, the browser has already decrypted the cookies in memory, allowing the malware to obtain their plaintext values without directly bypassing encryption on stored data.

AmnesiaStealer also uses Page.addScriptToEvaluateOnNewDocument to modify fingerprinting APIs. The goal is to reduce the likelihood that visited websites will identify the automated session.

Credentials, Documents, and Applications in the Crosshairs

The malware first attempts to unlock and read the macOS login keychain. It then searches Apple Notes and Telegram, as well as the Desktop, Documents, and Downloads folders.

The analysis also indicates that it searches for documents and files associated with cryptocurrency wallets. On the browser side, the target set includes 16 Chromium-based browsers, from which the malware attempts to steal cookies, credentials, browsing history, and extension data.

The results may include saved passwords, authentication cookies, and active sessions. The latter are especially significant: an already authenticated session may provide access to a service without requiring the password again and without necessarily triggering a new login flow.

During installation, the malware displays a native macOS window that mimics a password prompt. The entered value is verified locally using dscl. If the password is rejected, the window continues displaying the message “Incorrect password. Please try again”.

Once it obtains the correct value, AmnesiaStealer reuses it for multiple privileged operations, including sudo -S and security unlock-keychain -p. The password is also stored in plaintext in the staging file pwd and in the user’s home directory at ~/.pwd.

This extends the impact beyond a single browser. Compromising the local password can facilitate access to the keychain and other protected system resources.

Root Persistence and Chrome Safe Storage Manipulation

To survive reboots, AmnesiaStealer installs a LaunchDaemon that runs with root privileges. Its name imitates an Apple crash-reporting service: com.apple.ReportCrash.agent, followed by a random numeric suffix.

The configuration allows the malware to operate within the console user’s account. A LaunchDaemon with this name—particularly one that appears without a recognizable administrative change—should therefore be investigated immediately.

On macOS 26, the threat can tamper with the Chrome Safe Storage key. If it cannot retrieve the key through the usual procedures, it deletes it and replaces it with a key already known to the attacker.

This allows it to decrypt passwords and cookies collected afterward. However, the action also has a destructive effect: data stored previously may become inaccessible.

The behavior is therefore not limited to theft. It can alter the browser’s protection state and compromise the availability of information already stored.

Infrastructure Built for Multiple Campaigns

The command-and-control backend is called Amnesia Panel and is located at the root of the domain used for distribution. When authentication fails, the panel returns error messages in Russian.

The analysis identified the following URL pattern:

/d/command?t=token&b=build

The same pattern appears across multiple domains resolving to the same IP address. This behavior is consistent with a builder capable of generating different configurations for each campaign and embedding them in the payload.

The configurations are embedded as XOR-encrypted blobs. The family name, Russian-language messages, shared lure pages, and infrastructure reuse point to an organized operation rather than an isolated experiment.

It is not known whether AmnesiaStealer has been added to CISA’s KEV catalog, and the available information does not indicate a related remediation deadline. Based on the available data, it therefore cannot be treated as a vulnerability cataloged for active exploitation; it is malware distributed through social engineering.

What to Check on a Suspected Mac

The first indicator is a GitHub page that asks users to paste commands into Terminal. A legitimate project may provide command-line instructions, but a request presented as a mandatory alternative to downloading a file should be verified before execution.

The following should also be checked:

• macOS windows requesting a password and resembling an installation dialog;
• unusual use of dscl, sudo -S, and security unlock-keychain;
• the presence of the files pwd and ~/.pwd;
• LaunchDaemons with names resembling com.apple.ReportCrash.agent;
• deletion and recreation of Chrome Safe Storage entries through security;
• headless sessions and unusual Chrome DevTools Protocol calls;
• different domains sharing the /d/command?t=token&b=build pattern and the same resolved IP address.

Anyone who executed the command from the lure page should disconnect the Mac from the network and change credentials from a trusted device. Browser passwords and active sessions should be considered exposed; sessions must therefore be revoked, tokens regenerated where possible, and access to email, messaging, cloud services, and wallets reviewed.

The brief does not identify a single software update capable of remediating the infection. The primary defenses are avoiding the execution of commands copied from web pages, reviewing persistence mechanisms, and looking for the technical indicators left by the malware.