AmnesiaStealer: macOS Infostealer Hijacks Live Browser Sessions via Chrome DevTools Protocol Remote Control

AmnesiaStealer (TL-2026-2029), also tracked as Amnesia Panel, is a high-severity malware campaign, first published 2026-08-16 and last reviewed 2026-08-22. It has no confirmed attribution, affects Apple macOS, references 1 CVE (CVE-2020-9771), maps to 34 MITRE ATT&CK techniques (T1005, T1027, T1036.004), and is covered by 9 detection rules and 30 indicators of compromise.

Key facts for TL-2026-2029

Threat ID
TL-2026-2029
Also known as
Amnesia Panel
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-08-16
Last reviewed
2026-08-22
Attribution confidence
LOW
Motivation
FINANCIAL
Detection rules
9
Indicators of compromise
30
Updates
2026-08-22 · 3 updates · revalidated 3× · latest source

Malware and tooling in AmnesiaStealer

Malware and tooling: AmnesiaStealer, stream_module, Amnesia Panel

AmnesiaStealer is a newly documented three-stage Rust macOS infostealer, spread via ClickFix-style fake GitHub download pages, that harvests Keychain, browser, Apple Notes, Telegram, document, and crypto-wallet data, then on command deploys a stream_module that clones the victim's Chromium browser profile and gives a remote operator live ~3fps screencast keyboard/mouse/navigation control over the authenticated session via a dual WebSocket (operator relay + local Chrome DevTools Protocol) channel.

How AmnesiaStealer works

AmnesiaStealer is distributed through a ClickFix social-engineering chain: a counterfeit GitHub "Download for macOS" page (github.aoitour[.]com), styled with GitHub's dark theme and a fake "Verified Publisher" badge, instructs victims to open Terminal and paste a Base64-encoded Stage 0 command. That command pulls a short, self-deleting shell script from the attacker's /d/command endpoint, which downloads a password-protected ZIP archive (password "dulin") to /tmp/, extracts the Stage 1 Mach-O payload under a spoofed Apple path (/tmp/.com.apple.dt.[random]), strips the quarantine attribute, applies an ad-hoc code signature to satisfy Gatekeeper, and launches the binary via nohup before clearing shell history. Jamf Threat Labs also documented the loader muting device audio during install to suppress the Finder file-duplication sound that could tip off the victim.

Stage 1 is a Rust infostealer with a 4,064-byte XOR-encrypted (key "4mn3s1a_2o26!xK") embedded configuration carrying C2 endpoints and API keys. It displays a native AppKit NSAlert titled "Installer" ("Installer wants to make changes") to capture the victim's macOS account password, validates it locally against dscl, and stores it in cleartext in ~/.pwd and a /tmp/ staging directory. The captured password is reused to unlock the login/data-protection Keychain (security unlock-keychain -p) and for privileged reads. Stage 1 collects Apple Notes (NoteStore.sqlite plus WAL/SHM), Telegram session data (tdata/key_datas and account directories), documents from Desktop/Downloads/Documents (txt, pdf, rtf, doc, wallet, key, jpg, png, csv), profile data from 16 Chromium-based browsers (cookies, Login Data, History, Bookmarks, Extensions, Local State), cryptocurrency wallet-extension data via pattern matching on "Local Extension Settings," and a clipboard-hijacking (clipper) module that swaps copied wallet addresses for attacker-controlled ones across Bitcoin, Bitcoin Cash, Ethereum, TRON, Litecoin, Monero, Solana, Ripple, and Cosmos (ATOM). It also profiles the host (hardware UUID, macOS version, installed applications, public-IP geolocation). On macOS 26, when Chrome's Safe Storage key cannot be recovered from the login Keychain, the malware destructively overwrites it with a hardcoded value (pqz8N3vKxRmY2aLcQ), permanently obscuring the victim's own saved passwords/cookies while giving the operator a known key to decrypt future captures; the derived key is cached to ~/.local/share/.stream/.<browser>_key for Stage 2. The malware also attempts two previously-patched TCC/filesystem bypasses to reach Safari cookie data — an APFS snapshot mount via "mount_apfs -o nobrowse" (CVE-2020-9771) and direct SQLite writes to TCC.db — both of which Jamf found non-functional on current macOS unless the process already holds Full Disk Access. For persistence, Stage 1 installs a root LaunchDaemon at /tmp/starter, registered under /Library/LaunchDaemons/com.apple.ReportCrash.agent_<digits>.plist to impersonate Apple's crash-reporting service, configured with KeepAlive/RunAtLoad/SessionCreate.

Stage 2, stream_module (a.k.a. remote_stream), is fetched only on operator command. It clones victim profile data (Cookies, Login Data, Preferences, Local Storage, IndexedDB, Session Storage, Local State) into ~/.local/share/.stream/profiles/<browser> for seven Chromium engines (Chrome, Edge, Vivaldi, Arc, Opera, Brave, Chromium — the first documented instance of this technique on macOS), then launches the victim's real browser executable headless (--headless=old, --remote-debugging-port=, --remote-allow-origins=*) so the still-authenticated session survives the clone. It opens two WebSocket channels: one to the operator's relay server (registration frame {"type":"register","build_id":"...","browser":"..."}) and one to the local Chrome DevTools Protocol endpoint. The operator receives a live screencast of the session at roughly 3fps and can issue navigate, mouse_click, keyboard_input, tab-management, and export_cookies commands — the latter pulling cookies in plaintext via CDP's Network.getAllCookies, bypassing OS-level encryption entirely, while a parallel path re-encrypts on-disk profile cookies with the hardcoded Safe Storage key for later operator decryption. A "stealth script" injected via Page.addScriptToEvaluateOnNewDocument patches browser fingerprinting APIs to defeat automation/headless-browser detection on the sites the operator visits. stream_module is transient — it restarts the cloned Chrome instance up to a fixed retry limit and exits cleanly when the relay connection drops, leaving no persistence of its own.

Jamf named the family after a login panel discovered at the C2 root, "Amnesia Panel," whose failed-login error text is rendered in Russian — combined with the shared ClickFix lure template and builder-driven configuration also seen in the Atomic (AMOS) and MacSync stealer campaigns, this points to an established, financially-motivated, Russian-speaking stealer operation rather than a one-off tool, though Jamf stopped short of naming a specific actor or group.

MITRE ATT&CK techniques used in TL-2026-2029

Collection

T1005 Data from Local System; T1074.001 Data Staged; T1113 Screen Capture; T1119 Automated Collection; T1185 Browser Session Hijacking

Defense Evasion

T1027 Obfuscated Files or Information; T1036.004 Masquerading; T1036.005 Match Legitimate Resource Name or Location; T1070.003 Indicator Removal: Clear Command History; T1070.004 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1211 Exploitation for Defense Evasion; T1562.001 Impair Defenses; T1564.001 Hide Artifacts

Exfiltration

T1041 Exfiltration Over C2 Channel

Credential Access

T1056.002 Input Capture: GUI Input Capture; T1539 Steal Web Session Cookie; T1552.001 Unsecured Credentials: Credentials In Files; T1555.001 Credentials from Password Stores: Keychain; T1555.003 Credentials from Password Stores

Execution

T1059.002 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter: Unix Shell; T1204.004 User Execution: Malicious Copy and Paste

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer; T1219 Remote Access Software

Discovery

T1082 System Information Discovery; T1614 System Location Discovery

Persistence

T1543.004 Create or Modify System Process: Launch Daemon

Privilege Escalation

T1548.003 Abuse Elevation Control Mechanism; T1548.004 Abuse Elevation Control Mechanism; T1548.006 Abuse Elevation Control Mechanism

defense-impairment

T1553.001 Subvert Trust Controls: Gatekeeper Bypass

Resource Development

T1608.001 Stage Capabilities: Upload Malware

Affected products and versions in AmnesiaStealer

  • Apple — macOS
    Vulnerable versions: all macOS versions capable of running the 16 targeted Chromium-based browsers, including macOS 26
  • Apple — macOS (APFS snapshot / TCC filesystem-protection bypass, CVE-2020-9771)
    Vulnerable versions: macOS prior to 10.15.4 (Catalina)
    Fixed in: macOS 10.15.4 and later

Remediation for AmnesiaStealer

Patches

  • Ensure macOS is updated beyond 10.15.4 (Catalina) where CVE-2020-9771 was fixed; current macOS (26) is not vulnerable to this bypass without pre-existing Full Disk Access

Immediate actions

  • Block/sinkhole the identified domains (github.aoitour[.]com, debug.allllowef[.]space) and IPs (138.124.70[.]84, 138.124.96[.]160) at DNS/perimeter
  • Hunt for the persistence LaunchDaemon path /Library/LaunchDaemons/com.apple.ReportCrash.agent_<digits>.plist and the staging path /tmp/starter on macOS fleet endpoints
  • Hunt for /tmp/.com.apple.dt.* Mach-O payloads and ~/.pwd cleartext password files
  • Revoke and rotate credentials/sessions for any user who ran a ClickFix Terminal command from an untrusted 'Download for macOS' page, including browser cookies/sessions, Keychain items, Telegram sessions, and crypto wallet keys
  • Force re-authentication and rotate Chrome/Chromium Safe Storage-protected credentials on any host where Safe Storage key overwrite is suspected (macOS 26)

Workarounds

  • Do not paste or execute Terminal commands copied from web pages, especially install/fix instructions on unofficial download or 'error' pages
  • Treat any macOS system-password prompt triggered by a just-downloaded 'Installer' app as suspicious if it did not originate from a signed, notarized installer

Longer-term hardening

  • Deploy EDR/MDM detection for headless Chromium launches with --remote-debugging-port and --remote-allow-origins=* flags spawned by non-browser parent processes
  • Restrict/alert on user-initiated Terminal paste-and-run of Base64-encoded commands (ClickFix / T1204.004) via shell history and endpoint telemetry
  • Enforce Full Disk Access and TCC review policies so stale/legacy bypass paths (e.g., CVE-2020-9771-class APFS snapshot abuse) cannot be leveraged even opportunistically
  • User awareness training on ClickFix-style fake 'Verified Publisher' download pages and copy-paste Terminal install instructions

CVEs associated with AmnesiaStealer

CVE-2020-9771

Weaknesses (CWE) in AmnesiaStealer

NVD-CWE-noinfo

Timeline of AmnesiaStealer

  • Apple ships macOS Catalina 10.15.4, fixing the APFS-snapshot/TCC filesystem-protection bypass tracked as CVE-2020-9771. AmnesiaStealer's Stage 1 still attempts this bypass to reach Safari cookies; it is only functional on current macOS if the process already has Full Disk Access.
  • AppleInsider and MacTech independently publish coverage citing Jamf's findings on the counterfeit GitHub 'Verified Publisher' download page and the fake 'Installer' password-capture prompt used to unlock the Keychain.
  • Jamf Threat Labs publishes the first technical analysis of AmnesiaStealer, detailing its three-stage architecture (shell loader, Rust infostealer, stream_module) and the fake-GitHub ClickFix distribution chain.
  • Reporting highlights that failed logins on the C2's 'Amnesia Panel' return Russian-language error text, cited alongside the shared Atomic (AMOS)/MacSync distribution template as a soft attribution indicator toward an established Russian-speaking stealer operation.
  • The Hacker News, SecurityWeek, GBHackers, Security Affairs, and Infosecurity Magazine publish follow-on reporting summarizing the ClickFix infection chain, the crypto-clipper module, and the stream_module's CDP-based browser hijacking.
  • BleepingComputer publishes coverage of the stream_module's live ~3fps screencast browser-hijacking capability across 16 Chromium-based browsers, the source feed article for this threat record.
  • BeaconBeagle queried for both the C2 panel domain (debug.allllowef.space) and delivery domain (github.aoitour.com) returns no prior correlation records, indicating the infrastructure had not previously been cross-indexed against other tracked C2 activity.
  • QuoIntelligence publishes its Weekly Intelligence Snapshot for Week 34, 2026, listing AmnesiaStealer as a cyber highlight and corroborating Jamf's findings.

Update history for TL-2026-2029

Sources cited for AmnesiaStealer

Threats related to AmnesiaStealer

Detection coverage for TL-2026-2029

As of 2026-08-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2029 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats