Cybersecurity researchers have uncovered a new macOS information stealer called AmnesiaStealer that can take control of Chromium web browsers to extract session data and enable live, operator-driven browsing from infected machines. The malware was detailed in a report from Jamf Threat Labs shared with The Hacker News. Built in Rust, the multi-stage stealer represents a materially different level of access from traditional file collection because it allows hands-on-keyboard control of authenticated browser sessions in real time.
The attack spreads through a fake GitHub download page labeled "Download for macOS" that claims verification from a legitimate publisher. Victims are tricked into copying and pasting a Base64-encoded command into the macOS Terminal app using a ClickFix-style technique. This launches a three-stage deployment chain: a shell script that retrieves and executes the payload, a Rust infostealer that harvests the Keychain, browsers, Apple Notes, and Telegram, and a stream_module that provides hidden, interactive control of the victim's browser. The malware targets 16 Chromium-family browsers including Google Chrome, Brave, Arc, and Microsoft Edge, collecting cookies, login data, web data, browsing history, bookmarks, and extensions. It also steals data from Safari using a TCC bypass vulnerability (CVE-2020-9771) that works on macOS Catalina and macOS 26 when the malware has Full Disk Access. A clipboard-hijacking module can target nine cryptocurrencies including Bitcoin, Ethereum, Solana, and Monero. The stealer displays a native prompt disguised as an installer to capture the system password, validating it against the local directory service and looping until the correct password is entered. Files matching extensions like .txt, .pdf, .wallet, .key, and .jpg are swept from Desktop, Documents, and Download folders.
"The operator receives a live screencast of the session at around 3fps and can drive it with a full input set: keyboard, mouse, scroll, navigation and tab management," security researcher Thijs Xhaflaire said in the report. These actions are translated into Chrome DevTools Protocol calls against the headless browser in real time. The remote_stream command fetches a second Rust binary that launches the browser executable in headless mode and spawns a relay channel using WebSocket to accept operator commands. To prevent headless sessions from being flagged as automation, the module injects a script that patches several browser fingerprinting APIs. According to Jamf, "this is a hands-on-keyboard hidden browser session, not an automated dump."
Three features distinguish AmnesiaStealer from other macOS stealers like Atomic Stealer, MacSync, and CrashStealer: a builder-driven configuration that can be modified at the build level without code changes, operating system version-branched logic that attempts macOS bypasses already patched by Apple, and the remote-control second stage that enables attackers to steal user cookies and evade detection through a stealth script. The malware's name comes from a login page at the root of the command-and-control host titled "Amnesia Panel," which returns error messages in Russian when login attempts fail. The stealer establishes persistence through a root LaunchDaemon that impersonates Apple's crash reporting service, stages collected data in a randomly named directory under "/tmp," and then archives and exfiltrates it. The report concluded that "a working collector paired with a working browser-hijack stage, wrapped around a few dated bypasses, is what makes it worth tracking." Organizations relying on browser-based authentication face exposure not just to credential theft but to live session abuse that traditional security controls may struggle to detect. The combination of social engineering through trusted platforms and sophisticated technical bypasses suggests defenders will need layered strategies that go beyond endpoint detection alone.