AmnesiaStealer trades smash-and-grab for a live seat in the victim's browser

Jamf Threat Labs researchers disclosed AmnesiaStealer, a new multi-stage Rust-based macOS infostealer spread through a counterfeit GitHub download page using the ClickFix technique.

The stealer is installed through a fake GitHub 'Download for macOS' page instructing the victim to copy and paste a base64-encoded command into Terminal; the command retrieves a dropper script that downloads a password-protected ZIP archive, then extracts and executes the AmnesiaStealer payload. Infosecurity described the script as short, silent and self-deleting.

The lure page reproduces GitHub's dark theme, the Octocat logo and a 'Verified Publisher' badge, and presents a 'Terminal installation' box framed as a convenience for advanced users instead of a download button.

The malware attempts to recover the Safe Storage password for each browser; the author's comments note 'no keys recovered' on macOS 26 and above, leading to a fallback that overwrites the Safe Storage password with a hardcoded value, rendering previously stored passwords and cookies undecryptable.

Jamf researchers: 'This sequence is a high-value detection. Browsers create Safe Storage entries through the Security framework and never through the security binary, so a process deleting and rewriting one has no benign explanation.'

After basic reconnaissance the malware uses AppKit NSAlert to display a password prompt stating 'Installer wants to make changes.'

The malware validates the entered password locally against the directory service using dscl, looping with 'Incorrect password. Please try again' until the correct one is entered.

The Jamf report on AmnesiaStealer was published on August 13, according to Infosecurity Magazine.

Jamf: 'The captured password is then reused throughout the chain. It is piped into sudo -S for privileged reads, passed to security unlock-keychain -p, and written to disk in cleartext, both in the staging directory as pwd and in the user's home directory as ~/.pwd.'

Because the module clones the victim profile and controls the copy, the victim's own visible browser window is not affected and shows nothing unusual.

The stream module calls Network.getAllCookies over the Chrome DevTools Protocol against the headless session, which returns plaintext cookie values because the browser has already decrypted them in memory, sidestepping at-rest encryption.

The module injects a stealth script through Page.addScriptToEvaluateOnNewDocument to patch browser fingerprinting APIs, keeping the headless session from being flagged as automation by the sites it visits.

The C2 backend is named Amnesia Panel, sits at the root of the delivery domain, and returns error messages in Russian when login fails.

Jamf describes three stages: a shell script that downloads and launches the payload; a Rust infostealer that harvests the keychain, browsers, Apple Notes and Telegram; and a stream_module, fetched on command, giving the operator hidden interactive control of the victim's browser.

Infrastructure analysis shows the same URL pattern, /d/command?t=token&b=build, across multiple domains resolving to the same address, consistent with a builder that generates per-campaign configurations and embeds them in the payload as an XOR-encrypted blob.

Before beginning its stealing routine the malware mutes the system sound to prevent the user hearing the sound Finder plays when files are duplicated.

AmnesiaStealer mainly uses cat and cp to collect stolen files, but uses duplicate for Safari cookies, Notes attachments, Safari Form Values, ~/Library/Keychains/<hardware UUID> (which contains Keychain-related cryptographic material) and any Notes not obtained via cat.

Jamf Senior Threat and Detections Researcher Thijs Xhaflaire: 'Because duplicate makes Finder the process that reads each file, these steps access data the malware cannot directly reach without prompting the user. The Safari cookie step tries cat first and falls back to duplicate only when that fails.'

One Safari cookie theft fallback is an APFS snapshot bypass based on an exploit for CVE-2020-9771, patched by Apple in macOS Catalina 10.15.4 and 10.15.5; the technique now works only if Terminal or the malware process already holds Full Disk Access, which researchers note may be the case for power users and developers.

Persistence is installed as a root LaunchDaemon impersonating Apple's crash reporting service, com.apple.ReportCrash.agent with a random numeric suffix, configured to survive reboots under the console user's account.

For Chromium browser data theft the malware targets 16 distinct browsers, including Google Chrome, Brave, Arc and Microsoft Edge, copying the Extensions directory plus Cookies, Login Data, Login Data for Account, Web Data, History, Bookmarks, Local State and Preferences for each browser and profile.

The live-control stream module covers seven browsers against the 16 targeted for at-rest data theft, nine fewer.

In ClickFix-style attacks the user enters the command themselves, which bypasses many anti-virus and cyber defence tools that categorise the action as legitimate; Infosecurity Magazine reports research has shown ClickFix has become a leading means of malware delivery in 2026.