macOS Users Beware: New Malware Grants Hackers Live Browser Control
A new Rust-based infostealer named AmnesiaStealer is giving cybercriminals unprecedented control over macOS users’ browsers—without their knowledge. Discovered by Jamf Threat Labs researchers, the malware spreads through convincing fake GitHub pages that mimic the platform’s dark theme, Octocat logo, and even a “Verified Publisher” badge. Instead of a download button, victims are instructed to paste a Terminal command, a tactic known as the ClickFix technique. Once executed, AmnesiaStealer operates in three stages: a shell script fetches the payload, a Rust-based infostealer harvests sensitive data, and a stream module grants attackers real-time, hidden control over the victim’s browser.
A stealthy three-stage attack
The malware’s sophistication lies in its multi-phase execution. The initial shell script downloads and launches the payload, which then extracts passwords, cookies, browser data, and even Apple Notes. However, the most alarming feature is the stream module, which enables attackers to interact with the victim’s browser as if they were sitting at the keyboard. This headless browser session operates undetected, allowing hackers to navigate tabs, input keystrokes, and manage sessions—all while the victim sees nothing unusual on their screen. The module clones the browser profile and uses Chrome DevTools Protocol to extract plaintext cookies, bypassing at-rest encryption entirely.
Persistence and evasion tactics
AmnesiaStealer doesn’t stop at data theft—it also ensures persistence. The malware captures the user’s password via a fake macOS installer prompt, validating it locally before reusing it for privileged operations like unlocking the keychain or reading files. In a worrying twist for macOS 26, the malware deletes Chrome’s Safe Storage key and replaces it with a known key, enabling attackers to decrypt newly stolen credentials while potentially locking victims out of their own data. This unusual behavior could serve as a red flag for detection systems.
Why it matters
AmnesiaStealer represents a significant escalation in macOS threats, combining traditional infostealing with live browser hijacking—a capability previously rare in commodity malware. The shared lure infrastructure with other malware families like Atomic Stealer suggests a growing trend of modular, reusable attack tools. For macOS users, this means traditional antivirus may not be enough; vigilance against suspicious Terminal commands and unfamiliar GitHub pages is critical. The malware’s ability to bypass encryption and manipulate browser sessions underscores the need for layered security measures, including behavioral monitoring and strict user verification.
Source: Security Affairs. AI-assisted editorial synthesis — TechnoExpress.