Cybersecurity experts have recently highlighted a new threat targeting macOS systems, known as AmnesiaStealer. This Rust-based information stealer has the capability to compromise Chromium browsers, thereby allowing attackers to access and manipulate session data.
AmnesiaStealer’s Distribution and Infection Process
The malware is disseminated through a fake GitHub page that masquerades as a legitimate macOS download site. It tricks users into executing a Base64-encoded command in the macOS Terminal, which initiates a multi-stage attack sequence.
The attack begins with a shell script that downloads and activates the payload. Subsequently, a Rust-based infostealer extracts data from Keychain, browsers, and applications like Apple Notes and Telegram. The final stage involves a stream_module that enables the attacker to interact with the victim’s browser covertly.
Technical Details and Functionality
AmnesiaStealer employs a password-protected ZIP archive that self-destructs after extraction. The initial Mach-O binary is a Rust stealer equipped with customizable, encrypted settings. This includes command-and-control (C2) endpoints and a clipboard hijacking feature targeting cryptocurrency transactions.
The malware conducts host reconnaissance and geolocation profiling, using a native prompt to capture system passwords. If the password validation fails, it loops a prompt until the correct password is entered.
Advanced Capabilities and Persistence
The stealer can infiltrate 16 Chromium-based browsers, gathering sensitive data such as cookies, login information, and browser history. For Safari, it exploits a TCC bypass vulnerability to access user data.
AmnesiaStealer also establishes persistence by creating a LaunchDaemon that mimics Apple’s crash reporting service. It archives and exfiltrates collected data from directories named with random characters in the /tmp path.
The C2 server can issue a remote_stream command, prompting the malware to download a secondary Rust binary. This binary facilitates interactive control over browsers via the Chrome DevTools Protocol, allowing real-time manipulation of the victim’s browser environment.
Implications and Future Outlook
The AmnesiaStealer threat underscores the evolving sophistication of macOS-targeted malware. Its ability to hijack live browser sessions distinguishes it from typical data-stealing malware, presenting a significant risk to user privacy and security.
Security researchers emphasize the importance of staying informed and implementing robust cybersecurity measures to protect against such exploits. As macOS threats continue to develop, vigilance and proactive defense strategies remain crucial.
