A newly discovered malware, AmnesiaStealer, poses a significant threat to macOS users by granting hackers covert access to browsers on infected machines. This malicious tool goes beyond merely stealing saved passwords; it allows unauthorized control of browsers that are already logged in, effectively turning compromised Macs into gateways for accessing sensitive accounts without user awareness.
Exploiting Social Engineering for Malware Deployment
AmnesiaStealer leverages a social engineering technique known as ClickFix to deceive users into executing harmful commands. Victims are directed to a fake GitHub download page, where they are instructed to input a command into Terminal. This action initiates a multi-stage Rust-based payload while erasing evidence of its installation.
According to a report shared by Polyswarm with Cyber Security News, the malware targets a range of sensitive data, including credentials, browser histories, Apple Notes, Telegram session details, documents, and keychain information. Analysts have noted a shift in threats from mere data theft to exploiting authenticated browser sessions.
Persistent and Covert Browser Control
One of AmnesiaStealer’s key features is its ability to maintain persistent control through a concealed LaunchDaemon, making a single unsafe command sufficient for long-term compromise. Its second-stage browser streaming module enables attackers to duplicate a victim’s browser profile, operating it invisibly in a headless Chromium session.
The module uses the legitimate Chrome DevTools Protocol for interaction, allowing attackers to navigate websites, manage tabs, and execute various actions in real-time. This capability transforms the malware’s impact, enabling attackers to exploit valid sessions by accessing account pages, exporting cookies, and more.
Defense Strategies Against AmnesiaStealer
The adaptability of AmnesiaStealer, including its campaign-specific settings and execution pathways, complicates detection. Researchers emphasize the importance of recognizing behavioral indicators rather than relying on file signatures alone. Users are advised to remain cautious of web pages prompting them to enter commands into Terminal, even if they resemble trusted sites like GitHub.
Security teams should monitor for unusual Terminal activities, unexpected keychain accesses, and hidden Chromium launches, which are indicative of AmnesiaStealer’s presence. Additionally, understanding cross-platform ClickFix delivery chains can help identify the social engineering tactics before a breach occurs.
As cyber threats evolve, maintaining vigilance and implementing robust security measures are crucial to protecting sensitive information and ensuring the integrity of systems against advanced threats like AmnesiaStealer.
