A newly analysed piece of AmnesiaStealer macOS malware does something most infostealers do not: rather than simply dumping credentials and disappearing, it hands the attacker a live, operator-driven browser running entirely inside the victim’s machine. Researchers at Jamf have published a detailed breakdown of how the malware pulls this off, and the technical picture is uncomfortable reading for anyone who relies on browser-based authentication.
AmnesiaStealer, written in Rust, arrives via ClickFix campaigns that point victims to a fake GitHub download page. Clicking through drops a password-protected ZIP archive; a shell-script loader then unpacks and executes the Mach-O payload inside. The ClickFix template is not new: Jamf found it had previously been used to distribute the Atomic and MacSync infostealers, which suggests whoever is behind this campaign is recycling proven infrastructure.
What AmnesiaStealer macOS Malware Actually Collects
The collection scope is broad. The malware captures the macOS login password early in its execution and uses it to unlock the keychain, running the command security unlock-keychain -p ~/Library/Keychains/login.keychain-db and calling SecKeychainSetUserInteractionAllowed(false) to suppress any interactive prompts that might tip off the user, according to Jamf. From there it can harvest keychain data, Apple Notes, Telegram sessions, system information, and documents.
Browser coverage extends to 16 Chromium-based browsers, from which it can exfiltrate saved logins, browsing history, bookmarks, extensions, local state, cookies, and full profile data. Cryptocurrency wallet details are identified by enumerating browser extensions and IndexedDB data. Beyond Chromium, the malware also exploits an old TCC bypass, CVE-2020-9771, to steal Safari cookies and access the TCC database, as SecurityWeek reported. That particular vulnerability being pressed back into service here is a reminder that unpatched legacy flaws remain genuinely useful to attackers.
All collected data is reported back to a backend the researchers call the Amnesia Panel, giving the operator a consolidated view of exfiltrated material from infected hosts.
The Remote Stream Module: AmnesiaStealer’s Most Unusual Trick
Standard infostealer behaviour (grab files, exfiltrate, exit) is bad enough. AmnesiaStealer goes a step further with a component called stream_module, retrieved via the remote_stream command. This module does not just clone browser data; it clones the authenticated browser session itself and makes it remotely operable in real time.
The mechanism relies on the Chrome DevTools Protocol (CDP), the same debugging interface built into Chromium-based browsers for legitimate developer tooling. AmnesiaStealer can duplicate user profiles across seven Chromium-based browsers (Google Chrome, Microsoft Edge, Vivaldi, Arc, Opera, Brave, and Chromium) because they all share the same DevTools Protocol, launch flags, and cookie encryption. The module launches the legitimate browser executable in headless mode with command-line switches that weaken browser defences, loads the cloned profile, then opens two WebSocket channels.
The first channel connects to the operator’s relay and handles high-level commands: navigation, mouse clicks, tab management. The malware sends status and tab information back as JSON and transmits screencast frames as binary WebSocket messages. The second channel connects directly to the local headless Chromium instance via its webSocketDebuggerUrl, providing full CDP access. Together, these give the operator live, keyboard-and-mouse control over authenticated sessions, at around 3fps for the screencast feed.
Jamf put it plainly: ‘In effect the remote_stream command turns an infected host into a live, operator-driven browser running the victim’s authenticated sessions, which is a materially different level of access from file collection.’ The distinction matters. Stealing a session cookie is one thing; interactively operating the victim’s online banking portal, email, or corporate SaaS tools in a hidden window on their own machine is quite another.
CDP has been abused by malware before, Chaos ransomware used it to obscure command-and-control traffic, and Chaes used it to expose browser functions for data theft. AmnesiaStealer appears to be the first documented macOS malware to combine a cloned Chromium profile with CDP-based live remote control in this way.
A Fallback for macOS 26 and What Users Can Do
There is an additional wrinkle for users on macOS 26. When the malware cannot recover the existing Chrome Safe Storage key on that version, it replaces it with an attacker-supplied value. Previously stored cookies and passwords become permanently unreadable to the legitimate user, while the attacker retains the ability to decrypt data collected after that point.
Apple device users are advised never to execute terminal commands found online that they do not fully understand, which is the entry point ClickFix campaigns exploit. The fake GitHub page instructs victims to paste a command into Terminal, the kind of social-engineering step that looks plausible precisely because developers and technically curious users do occasionally run shell commands from the web.
Jamf’s full technical write-up, including indicators of compromise, is available for defenders looking to build detections around the stream_module behaviour and the specific launch flags AmnesiaStealer passes to headless Chromium.
