Cybersecurity researchers have disclosed details of a new macOS-oriented, Rust-based information stealer called AmnesiaStealer that's capable of hijacking Chromium web browsers to steal session data.
The multi-stage stealer is spread via a counterfeit GitHub download page titled "Download for macOS" and claims to be from a verified publisher. The page employs a ClickFix-style lure that instructs users to copy and paste a Base64-encoded command into the macOS Terminal app.
The attack chain ultimately leads to the deployment of AmnesiaStealer via a dropper script hosted on a remote server, which, according to Jamf Threat Labs, runs in three distinct stages.
"The first is a shell script that downloads and launches the payload," security researcher Thijs Xhaflaire said in a report shared with The Hacker News. "The second is a Rust infostealer that harvests the Keychain, browsers, Apple Notes, and Telegram. The third is a stream_module, fetched on command, that gives the operator hidden, interactive control of the victim's browser."
The script is designed to retrieve a password-protected ZIP archive and delete itself from the host. Extracted from the archive is the first-stage Mach-O binary, a Rust stealer that includes an embedded encrypted configuration that can be modified at the build level through the configuration without making any code changes. It includes the following details -
- Command-and-control (C2) endpoints (i.e., "debug.allllowef[.]space/send/")
- Enable or disable a clipboard-hijacking (aka clipper) module ("CLIPPER_ENABLED") capable of targeting cryptocurrencies like Bitcoin, Bitcoin Cash, Ethereum, TRON, Litecoin, Monero, Solana, Ripple, and Cosmos (ATOM).
The Rust payload also performs host reconnaissance and geolocation profiling, and displays a native prompt to capture the system password under the guise of an installer. The entered password is validated against the local directory service via dscl to ensure that only the correct password is exfiltrated.
If the check fails, it triggers a dialog loop with the message "Incorrect password. Please try again." until the correct password is entered. "A fallback path writes /tmp/tempAppleScript.scpt and invokes osascript if the native alert fails, though on our host the native path succeeded and no osascript prompt was raised," Jamf said.
"The captured password is then reused throughout the chain. It is piped into sudo -S for privileged reads, passed to security unlock-keychain -p , and written to disk in cleartext, both in the staging directory as pwd and in the user's home directory as ~/.pwd."
It's worth noting that this behavior has also been observed in another macOS stealer family called ClickLock Stealer that has targeted users located in Europe, North America, the Middle East, and Africa via phishing pages employing the ClickFix technique.
Also present is an AppleScript file that mutes the system sound and then proceeds to harvest data from Apple Notes, Telegram sessions, Safari, files matching certain extensions (.txt, .pdf, .rtf, .doc, .wallet, .key, .jpg, .png, and .csv) across ~/Desktop, ~/Documents, and ~/Download folders, and iCloud Keychain using the captured system password.
Some of the other actions performed by the stealer are as follows-
- Target 16 Chromium-family browsers, including Google Chrome, Brave, Arc, and Microsoft Edge, to gather Cookies, Login Data,
- Login Data for Account, Web Data, History, Bookmarks, Local State, Preferences, and the Extensions directory.
- Read Chrome Safe Storage password from the Keychain and use it to recover master keys that are used to secure data stored in a user's Chrome profile folder.
- Steal cookies from Safari based on the macOS version, using a TCC bypass flaw (CVE-2020-9771) to target macOS machines running Catalina. The technique also works on macOS 26 but only when the malware possesses Full Disk Access (which it does not).
- Establish persistence by means of a root LaunchDaemon that impersonates Apple's crash reporting service.
- Stage collected data in a directory named with 25 random alphanumeric characters under "/tmp" and then archive and exfiltrate it.
Furthermore, the "remote_stream" command issued by the C2 server becomes a trigger for the first stage payload to fetch and execute a second Rust binary from the same infrastructure that enables interactive remote control over the Chrome DevTools Protocol (CDP).
The module supports seven Chromium-family browsers, namely Chrome, Brave, Microsoft Edge, Arc, Opera, Vivaldi, and Chromium, and launches the browser executable in headless mode to steal browser-related data. It also spawns a relay channel using WebSocket to accept operator commands and report the status back to the same endpoint. The commands allow the threat actor to remotely control the browser and facilitate key presses, mouse clicks, scrolling, navigation, and tab management.
To avoid the headless sessions from being flagged as automation by the sites visited by the malware, the module injects a script that patches several browser fingerprinting APIs. It has no persistence of its own and runs under the main payload.
"The operator receives a live screencast of the session at around 3fps and can drive it with a full input set: keyboard, mouse, scroll, navigation and tab management," Jamf said. "These are translated into CDP calls against the headless browser in real time. This is a hands-on-keyboard hidden browser session, not an automated dump."
"In effect, the remote_stream command turns an infected host into a live, operator-driven browser running the victim's authenticated sessions, which is a materially different level of access from file collection."
While the overall objectives of the malware are consistent with other stealers like Atomic Stealer, MacSync, and CrashStealer, three different aspects set it apart: a builder-driven configuration, operating system version-branched logic that reaches for macOS bypasses already patched by Apple, and a remote-control second stage that allows attackers to steal user cookies and evade detection through a stealth script that patches browser fingerprinting APIs.
AmnesiaStealer gets its name from a login page located at the root of the C2 host with the name "Amnesia Panel." A failed login returns an error message in Russian, urging users to provide a correct login or password to sign in to the operator.
"AmnesiaStealer sets out to harvest credentials, browser data, and live sessions from macOS users, and it delivers on some of that more than the rest," Jamf said. "A working collector paired with a working browser-hijack stage, wrapped around a few dated bypasses, is what makes it worth tracking."
