A multi-stage Rust-based macOS information stealer has been distributed through a counterfeit GitHub download page in recent ClickFix attacks, Jamf reports.
The fake download page lures victims into pasting a command into Terminal, which leads to the newly discovered AmnesiaStealer being installed.
As part of a three-stage infection chain, a shell script runs to fetch and execute the payload, the infostealer harvests data, and a third module is run on command to provide interactive control over the victims’ browsers.
“Its objectives overlap with families such as Atomic (AMOS), MacSync and CrashStealer. Three traits set it apart: a builder-driven configuration, OS version-branched logic that reaches for patched macOS bypasses, and the remote-control second stage,” Jamf notes.
After execution, the malware performs reconnaissance, prompts the user to provide their login password and validates it locally, copies login and data-protection keychains, and harvests Chromium-based browser databases, Apple Notes, and documents.
AmnesiaStealer also attempts two Transparency, Consent, and Control (TCC) framework bypasses to gain Safari cookie and full disk access, archives the harvested data and sends it to the command-and-control (C&C) server, and installs a LaunchDaemon for persistence.
If it receives a remote_stream command, the malware downloads and runs a stream module that clones the victim’s browser profile and launches it headless to provide the attackers with full control over the browser session.
The information stealer targets six Chromium-based browsers, including Chrome, Brave, Arc, and Edge, and was seen overwriting the per-browser Safe Storage key in the login keychain with an attacker-controlled value, rendering previously saved passwords and cookies unrecoverable.
“The malware accepts that loss: unable to recover the existing key on macOS 26, it swaps the victim’s saved data for a key the operator already knows, so anything encrypted afterward can be decrypted operator-side,” Jamf notes.
To steal Safari cookies and access the TCC database, the malware uses an old TCC bypass (CVE-2020-9771). On macOS 26, the attack works only if the Terminal or the malware process already has Full Disk Access.
The final stream module, which is executed on demand, is an interactive remote-control component that uses the Chrome DevTools Protocol (CDP) to launch a headless copy of the browser, creating a relay channel through which the attacker can control the victim’s browser session.
“The operator receives a live screencast of the session at around 3fps and can drive it with a full input set: keyboard, mouse, scroll, navigation, and tab management. These are translated into CDP calls against the headless browser in real time. This is a hands-on-keyboard hidden browser session, not an automated dump,” Jamf notes.
Related: Mozilla Issues New Firefox GPG Key Following Exposure
Related: ‘Ghostjacking’ Attack Uses Poisoned Logs to Turn AI Agents Bad