AmnesiaStealer: macOS Infostealer Hijacks Live Browser Sessions via Chrome DevTools Protocol Remote Control — Threadlinqs Intelligence
As of 2026-08-22, AmnesiaStealer: macOS Infostealer Hijacks Live Browser Sessions via Chrome DevTools Protocol Remote Control is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-2029 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Updated: 2026-08-22 · 3 updates · revalidated 3× · latest source
AmnesiaStealer is a newly documented three-stage Rust macOS infostealer, spread via ClickFix-style fake GitHub download pages, that harvests Keychain, browser, Apple Notes, Telegram, document, and
AmnesiaStealer is distributed through a ClickFix social-engineering chain: a counterfeit GitHub "Download for macOS" page (github.aoitour[.]com), styled with GitHub's dark theme and a fake "Verified Publisher" badge, instructs victims to open Terminal and paste a Base64-encoded Stage 0 command. That command pulls a short, self-deleting shell script from the attacker's /d/command endpoint, which downloads a password-protected ZIP archive (password "dulin") to /tmp/, extracts the Stage 1 Mach-O payload under a spoofed Apple path (/tmp/.com.apple.dt.[random]), strips the quarantine attribute, applies an ad-hoc code signature to satisfy Gatekeeper, and launches the binary via nohup before clearing shell history. Jamf Threat Labs also documented the loader muting device audio during install to suppress the Finder file-duplication sound that could tip off the victim.
Stage 1 is a Rust infostealer with a 4,064-byte XOR-encrypted (key "4mn3s1a_2o26!xK") embedded configuration carrying C2 endpoints and API keys. It displays a native AppKit NSAlert titled "Installer" ("Installer wants to make changes") to capture the victim's macOS account password, validates it locally against dscl, and stores it in cleartext in ~/.pwd and a /tmp/ staging directory. The captured password is reused to unlock the login/data-protection Keychain (security unlock-keychain -p) and for privileged reads. Stage 1 collects Apple Notes (NoteStore.sqlite plus WAL/SHM), Telegram session data (tdata/key_datas and account directories), documents from Desktop/Downloads/Documents (txt, pdf, rtf, doc, wallet, key, jpg, png, csv), profile data from 16 Chromium-based browsers (cookies, Login Data, History, Bookmarks, Extensions, Local State), cryptocurrency wallet-extension data via pattern matching on "Local Extension Settings," and a clipboard-hijacking (clipper) module that swaps copied wallet addresses for attacker-controlled ones across Bitcoin, Bitcoin Cash, Ethereum, TRON, Litecoin, Monero, Solana, Ripple, and Cosmos (ATOM). It also profiles the host (hardware UUID, macOS version, installed applications, public-IP geolocation). On macOS 26, when Chrome's Safe Storage key cannot be recovered from the login Keychain, the malware destructively overwrites it with a hardcoded value (pqz8N3vKxRmY2aLcQ), permanently obscuring the victim's own saved passwords/cookies while giving the operator a known key to decrypt future captures; the derived key is cached to ~/.local/share/.stream/.<browser>_key for Stage 2. The malware also attempts two previously-patched TCC/filesystem bypasses to reach Safari cookie data — an APFS snapshot mount via "mount_apfs -o nobrowse" (CVE-2020-9771) and direct SQLite writes to TCC.db — both of which Jamf found non-functional on current macOS unless the process already holds Full Disk Access. For persistence, Stage 1 installs a root LaunchDaemon at /tmp/starter, registered under /Library/LaunchDaemons/com.apple.ReportCrash.agent_<digits>.plist to impersonate Apple's crash-reporting service, configured with KeepAlive/RunAtLoad/SessionCreate.
Stage 2, stream_module (a.k.a. remote_stream), is fetched only on operator command. It clones victim profile data (Cookies, Login Data, Preferences, Local Storage, IndexedDB, Session Storage, Local State) into ~/.local/share/.stream/profiles/<browser> for seven Chromium engines (Chrome, Edge, Vivaldi, Arc, Opera, Brave, Chromium — the first documented instance of this technique on macOS), then launches the victim's real browser executable headless (--headless=old, --remote-debugging-port=, --remote-allow-origins=*) so the still-authenticated session survives the clone. It opens two WebSocket channels: one to the operator's relay server (registration frame {"type":"register","build_id":"...","browser":"..."}) and one to the local Chrome DevTools Protocol endpoint. The operator receives a live screencast of the session at roughly 3fps and can issue navigate, mouse_click, keyboard_input, tab-management, and ex
Weaknesses (CWE)
NVD-CWE-noinfo
Timeline
- Apple ships macOS Catalina 10.15.4, fixing the APFS-snapshot/TCC filesystem-protection bypass tracked as CVE-2020-9771. AmnesiaStealer's Stage 1 still attempts this bypass to reach Safari cookies; it is only functional on current macOS if the process already has Full Disk Access.
- Jamf Threat Labs publishes the first technical analysis of AmnesiaStealer, detailing its three-stage architecture (shell loader, Rust infostealer, stream_module) and the fake-GitHub ClickFix distribution chain.
- AppleInsider and MacTech independently publish coverage citing Jamf's findings on the counterfeit GitHub 'Verified Publisher' download page and the fake 'Installer' password-capture prompt used to unlock the Keychain.
- The Hacker News, SecurityWeek, GBHackers, Security Affairs, and Infosecurity Magazine publish follow-on reporting summarizing the ClickFix infection chain, the crypto-clipper module, and the stream_module's CDP-based browser hijacking.
- Reporting highlights that failed logins on the C2's 'Amnesia Panel' return Russian-language error text, cited alongside the shared Atomic (AMOS)/MacSync distribution template as a soft attribution indicator toward an established Russian-speaking stealer operation.
- BleepingComputer publishes coverage of the stream_module's live ~3fps screencast browser-hijacking capability across 16 Chromium-based browsers, the source feed article for this threat record.
- BeaconBeagle queried for both the C2 panel domain (debug.allllowef.space) and delivery domain (github.aoitour.com) returns no prior correlation records, indicating the infrastructure had not previously been cross-indexed against other tracked C2 activity.
- QuoIntelligence publishes its Weekly Intelligence Snapshot for Week 34, 2026, listing AmnesiaStealer as a cyber highlight and corroborating Jamf's findings.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, CVE-2020-9771, T1608.001, T1204.004, T1059.004, T1543.004, T1140, T1027, T1553.001, T1036.005, T1070.003, T1555.001
