AmnesiaStealer for macOS harvests keychains, hijacks browsers

Security researchers at Jamf report a multi-stage macOS information stealer called AmnesiaStealer is being distributed through a counterfeit GitHub download page in recent ClickFix attacks. The fake page prompts victims to paste a Terminal command that runs a shell script and pulls a three-part payload onto the system.

The infection chain begins with an initial downloader that fetches two additional modules. The second module collects credentials and files, and the third can be deployed on demand to provide interactive control over a user’s browser. The malware performs system reconnaissance, prompts the user for their macOS login password and validates that password locally before proceeding to copy both the login and data-protection keychains.

AmnesiaStealer harvests data from multiple Chromium-based browsers and other local stores. Jamf observed the tool targeting six Chromium browsers, including Chrome, Brave, Arc and Edge, and extracting browser databases, Apple Notes and documents. The malware archives collected data and sends it to a command-and-control server, and it installs a LaunchDaemon to maintain persistence.

The malware attempts to bypass the macOS Transparency, Consent, and Control framework in two ways to access Safari cookies and the TCC database; one of the methods leverages an older vulnerability tracked as CVE-2020-9771. Jamf notes that on macOS 26 those TCC-based techniques will only succeed if Terminal or the malware process already has Full Disk Access.

AmnesiaStealer also tampers with per-browser Safe Storage keys kept in the login keychain. Researchers observed the malware overwriting the existing Safe Storage key with a value known to the operator. On affected systems this can make stored passwords and cookies unrecoverable to the user and allow attackers to decrypt new credentials or cookies saved after the overwrite.

When sent a remote_stream command, the malware downloads a stream module that clones the victim’s browser profile and launches a headless instance under attacker control. That module uses the Chrome DevTools Protocol to create a live relay of the browser session. Jamf’s analysis shows the attacker receives a low-frame-rate screencast and can drive the session with keyboard and mouse input, scroll, navigation and tab management translated into DevTools calls in real time.

Jamf describes three technical features that distinguish AmnesiaStealer: a builder-driven configuration that lets operators customize builds, branching logic that picks bypass techniques based on the macOS version, and the interactive remote-control component that runs only when the operator requests it. The campaign relies on social engineering via the fake GitHub page to get users to run Terminal commands, which leads to execution of the multi-stage payload.