AmnesiaStealer Malware Targets macOS Through Fake Sites

A newly detected macOS malware named AmnesiaStealer is making rounds, exploiting a fraudulent GitHub download page to deceive Mac users. The attackers lure victims into executing a malicious Terminal command that installs the malware discreetly, potentially allowing attackers to take over the victim’s browser sessions without detection.

Deceptive GitHub Page

Researchers from Jamf Threat Labs identified this threat, discovering a fake website at github.aoitour[.]com, which closely mimics GitHub’s appearance, complete with the dark theme and logos. The site falsely claims to offer a ‘Terminal installation’ guide, encouraging users to execute a command in their Terminal, thereby granting malware access to their systems.

This social engineering tactic, known as ClickFix, has been previously employed to distribute other malware strains like Atomic (AMOS) and MacSync. It demonstrates the reuse of deceptive methods by cybercriminals across different campaigns.

Malware Execution and Capabilities

Upon execution of the command, a concealed shell script downloads and extracts a disguised binary, launching the payload while erasing traces of its activities. The malware, leveraging a Rust-based infostealer, profiles the system and captures login credentials by mimicking an installation prompt.

It accesses sensitive information, including keychain details, browser data, and social media sessions. The attack’s sophistication is evident in its ability to clone browser profiles in headless mode, granting attackers live access to the victim’s online activities.

Preventive Measures and Security Recommendations

Despite attempts to evade Apple’s privacy controls, many of the malware’s techniques are outdated on newer macOS versions. Nevertheless, the core functionality of credential and session hijacking remains effective, particularly against users with broad system permissions.

To safeguard against such threats, users are advised never to execute unfamiliar Terminal commands, especially from unverified download sources. Regularly updating macOS, enabling comprehensive threat protection, and exercising caution with any software installation prompts are critical defense strategies.

The ongoing evolution of AmnesiaStealer highlights the importance of vigilance and proactive security measures in protecting macOS users from increasingly sophisticated cyber threats.