AmnesiaStealer macOS Malware Enables Live Chromium Session Hijacking

Summary

AmnesiaStealer is a multi-stage, Rust-based macOS information stealer that has been observed in the wild. It is distributed through counterfeit GitHub download pages that use ClickFix-style social engineering to convince users to paste a malicious command into Terminal.

The malware captures the user's macOS login password and collects Keychain files, browser data, Apple Notes, documents, Telegram data, and cryptocurrency-wallet-related browser information. An optional second-stage module can also give an attacker hidden, interactive control of an authenticated Chromium browser session.

What happened

The infection begins with a counterfeit GitHub page displaying a fake "Download for macOS" or Terminal installation workflow. Instead of providing a normal application download, the page instructs the user to copy and paste a command into Terminal.

The command retrieves a shell script that downloads a password-protected archive, extracts the AmnesiaStealer payload, and executes it from a hidden location under /tmp.

After execution, the malware profiles the system and displays a fraudulent Installer-style password prompt. The submitted password is validated locally and reused to unlock the user's Keychain, perform privileged operations, and install persistence through a LaunchDaemon.

The primary payload targets 16 Chromium-family browsers and collects cookies, login databases, browsing history, autofill information, bookmarks, extensions, and other profile data. It also targets Apple Notes, documents, Telegram sessions, Keychain files, and browser-based cryptocurrency wallet information.

On macOS 26 or later, AmnesiaStealer may replace a Chromium Safe Storage key with an attacker-controlled value if normal key recovery fails. This is a conditional and destructive fallback, not the malware's default behavior. Previously encrypted browser data may become unrecoverable, while data encrypted after the replacement may be accessible using the attacker-controlled key.

Live browser control

When AmnesiaStealer receives a remote_stream command, it downloads a separate Rust-based module. This component clones the victim's Chromium profile and launches a hidden browser instance in headless mode.

The module supports Google Chrome, Brave, Microsoft Edge, Arc, Opera, Vivaldi, and Chromium. It uses the Chrome DevTools Protocol to provide the operator with keyboard input, mouse control, scrolling, navigation, tab management, and cookie export.

Jamf observed the module streaming the headless browser session at approximately three frames per second. Because the module operates against a cloned browser profile, the victim's visible browser window is not directly controlled.

This capability may allow an attacker to operate within an existing authenticated session without completing the initial login and MFA process again. It does not universally defeat MFA. Reauthentication, device binding, conditional-access policies, and transaction-level verification may still block the attacker.

TCC and CVE-2020-9771 clarification

AmnesiaStealer attempts an APFS snapshot technique associated with CVE-2020-9771 to access Safari cookies and the TCC database. Apple fixed this vulnerability in macOS Catalina 10.15.4.

Jamf determined that the malware only partially reused the original technique and did not use the mount option responsible for the original privilege bypass. In Jamf's macOS 26 testing, the attempt failed unless Terminal or the malware process already had Full Disk Access.

The malware also attempted to modify the TCC database to grant itself Full Disk Access. Jamf observed this attempt failing on macOS 26 because of existing Apple protections.

CVE-2020-9771 should therefore be treated as a related, patched technique rather than an actively exploited vulnerability affecting current macOS systems.

Why it matters

AmnesiaStealer extends beyond conventional information theft by giving an attacker interactive access to a browser running a copy of the victim's authenticated profile.

This may expose corporate email, cloud applications, developer platforms, social media accounts, financial services, and other sensitive systems. The actual impact depends on the information collected, the sessions active at the time of infection, and whether affected services require additional authentication for sensitive actions.

The malware has been observed in the wild, but Jamf has not publicly established the number of victims or the overall scale of the campaign.

Affected systems

• Apple macOS with version-dependent behavior
• Sixteen Chromium-family browsers targeted by the primary stealer
• Google Chrome, Brave, Microsoft Edge, Arc, Opera, Vivaldi, and Chromium supported by the live-control module
• Safari data when the responsible process has sufficient permissions
• macOS login and data-protection Keychains
• Apple Notes
• Telegram session data
• Files stored in Desktop, Documents, and Downloads
• Browser extensions and cryptocurrency wallet data

Recommended actions

1. Isolate confirmed or suspected infected Macs from the network.
2. From a separate trusted device, invalidate active sessions for email, password managers, financial services, cloud platforms, developer services, and other sensitive applications.
3. Rotate the affected user's macOS login password and credentials stored in the Keychain or browser.
4. Review Full Disk Access permissions and remove access from applications that do not require it.
5. Investigate suspicious Terminal activity involving Base64 decoding, curl, bash, zsh, nohup, or execution from temporary directories.
6. Monitor Chromium processes for unexpected use of --headless, --remote-debugging-port, or --remote-allow-origins.
7. Hunt for suspicious LaunchDaemons and AmnesiaStealer filesystem artifacts.
8. Reimage confirmed enterprise endpoints according to the organization's incident-response policy.