# AmnesiaStealer: macOS Infostealer Hijacks Live Browser Sessions via Chrome DevTools Protocol Remote Control

> AmnesiaStealer is a newly documented three-stage Rust macOS infostealer, spread via ClickFix-style fake GitHub download pages, that harvests Keychain, browser, Apple Notes, Telegram, document, and crypto-wallet data, then on command deploys a stream_module that clones the victim's Chromium browser profile and gives a remote operator live ~3fps screencast keyboard/mouse/navigation control over the authenticated session via a dual WebSocket (operator relay + local Chrome DevTools Protocol) channel.

- **Published:** 2026-08-16T00:00:00Z
- **Last reviewed:** 2026-08-22T06:55:53.123Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2029
- **ID:** TL-2026-2029
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2020-9771

## Description

AmnesiaStealer is distributed through a ClickFix social-engineering chain: a counterfeit GitHub "Download for macOS" page (github.aoitour[.]com), styled with GitHub's dark theme and a fake "Verified Publisher" badge, instructs victims to open Terminal and paste a Base64-encoded Stage 0 command. That command pulls a short, self-deleting shell script from the attacker's /d/command endpoint, which downloads a password-protected ZIP archive (password "dulin") to /tmp/, extracts the Stage 1 Mach-O payload under a spoofed Apple path (/tmp/.com.apple.dt.[random]), strips the quarantine attribute, applies an ad-hoc code signature to satisfy Gatekeeper, and launches the binary via nohup before clearing shell history. Jamf Threat Labs also documented the loader muting device audio during install to suppress the Finder file-duplication sound that could tip off the victim.

Stage 1 is a Rust infostealer with a 4,064-byte XOR-encrypted (key "4mn3s1a_2o26!xK") embedded configuration carrying C2 endpoints and API keys. It displays a native AppKit NSAlert titled "Installer" ("Installer wants to make changes") to capture the victim's macOS account password, validates it locally against dscl, and stores it in cleartext in ~/.pwd and a /tmp/ staging directory. The captured password is reused to unlock the login/data-protection Keychain (security unlock-keychain -p) and for privileged reads. Stage 1 collects Apple Notes (NoteStore.sqlite plus WAL/SHM), Telegram session data (tdata/key_datas and account directories), documents from Desktop/Downloads/Documents (txt, pdf, rtf, doc, wallet, key, jpg, png, csv), profile data from 16 Chromium-based browsers (cookies, Login Data, History, Bookmarks, Extensions, Local State), cryptocurrency wallet-extension data via pattern matching on "Local Extension Settings," and a clipboard-hijacking (clipper) module that swaps copied wallet addresses for attacker-controlled ones across Bitcoin, Bitcoin Cash, Ethereum, TRON, Litecoin, Monero, Solana, Ripple, and Cosmos (ATOM). It also profiles the host (hardware UUID, macOS version, installed applications, public-IP geolocation). On macOS 26, when Chrome's Safe Storage key cannot be recovered from the login Keychain, the malware destructively overwrites it with a hardcoded value (pqz8N3vKxRmY2aLcQ), permanently obscuring the victim's own saved passwords/cookies while giving the operator a known key to decrypt future captures; the derived key is cached to ~/.local/share/.stream/.<browser>_key for Stage 2. The malware also attempts two previously-patched TCC/filesystem bypasses to reach Safari cookie data — an APFS snapshot mount via "mount_apfs -o nobrowse" (CVE-2020-9771) and direct SQLite writes to TCC.db — both of which Jamf found non-functional on current macOS unless the process already holds Full Disk Access. For persistence, Stage 1 installs a root LaunchDaemon at /tmp/starter, registered under /Library/LaunchDaemons/com.apple.ReportCrash.agent_<digits>.plist to impersonate Apple's crash-reporting service, configured with KeepAlive/RunAtLoad/SessionCreate.

Stage 2, stream_module (a.k.a. remote_stream), is fetched only on operator command. It clones victim profile data (Cookies, Login Data, Preferences, Local Storage, IndexedDB, Session Storage, Local State) into ~/.local/share/.stream/profiles/<browser> for seven Chromium engines (Chrome, Edge, Vivaldi, Arc, Opera, Brave, Chromium — the first documented instance of this technique on macOS), then launches the victim's real browser executable headless (--headless=old, --remote-debugging-port=, --remote-allow-origins=*) so the still-authenticated session survives the clone. It opens two WebSocket channels: one to the operator's relay server (registration frame {"type":"register","build_id":"...","browser":"..."}) and one to the local Chrome DevTools Protocol endpoint. The operator receives a live screencast of the session at roughly 3fps and can issue navigate, mouse_click, keyboard_input, tab-management, and export_cookies commands — the latter pulling cookies in plaintext via CDP's Network.getAllCookies, bypassing OS-level encryption entirely, while a parallel path re-encrypts on-disk profile cookies with the hardcoded Safe Storage key for later operator decryption. A "stealth script" injected via Page.addScriptToEvaluateOnNewDocument patches browser fingerprinting APIs to defeat automation/headless-browser detection on the sites the operator visits. stream_module is transient — it restarts the cloned Chrome instance up to a fixed retry limit and exits cleanly when the relay connection drops, leaving no persistence of its own.

Jamf named the family after a login panel discovered at the C2 root, "Amnesia Panel," whose failed-login error text is rendered in Russian — combined with the shared ClickFix lure template and builder-driven configuration also seen in the Atomic (AMOS) and MacSync stealer campaigns, this points to an established, financially-motivated, Russian-speaking stealer operation rather than a one-off tool, though Jamf stopped short of naming a specific actor or group.

## MITRE ATT&CK

- T1608.001 Stage Capabilities: Upload Malware
- T1204.004 User Execution: Malicious Copy and Paste
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1543.004 Create or Modify System Process: Launch Daemon
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1553.001 Subvert Trust Controls: Gatekeeper Bypass
- T1036.005 Match Legitimate Resource Name or Location
- T1070.003 Indicator Removal: Clear Command History
- T1555.001 Credentials from Password Stores: Keychain
- T1552.001 Unsecured Credentials: Credentials In Files
- T1056.002 Input Capture: GUI Input Capture
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1005 Data from Local System
- T1113 Screen Capture
- T1185 Browser Session Hijacking
- T1071.001 Application Layer Protocol: Web Protocols
- T1548.003 Abuse Elevation Control Mechanism
- T1070.004 Indicator Removal
- T1562.001 Impair Defenses
- T1119 Automated Collection
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1059.002 Command and Scripting Interpreter
- T1548.004 Abuse Elevation Control Mechanism
- T1211 Exploitation for Defense Evasion
- T1036.004 Masquerading
- T1614 System Location Discovery
- T1219 Remote Access Software
- T1548.006 Abuse Elevation Control Mechanism
- T1564.001 Hide Artifacts
- T1555.003 Credentials from Password Stores
- T1074.001 Data Staged

## Sources

- [New AmnesiaStealer macOS malware hijacks browser sessions via remote control](https://www.bleepingcomputer.com/news/security/new-amnesiastealer-macos-malware-hijacks-browser-sessions-via-remote-control/)
- [AmnesiaStealer: macOS Infostealer That Hijacks Browsers](https://www.jamf.com/blog/amnesia-stealer-macos-infostealer-clickfix/)
- [Jamf Threat Labs releases report of macOS malware dubbed 'AmnesiaStealer'](https://www.mactech.com/2026/08/13/jamf-threat-labs-releases-report-of-macos-malware-dubbed-amnesiastealer/)
- [Fake GitHub download turns Safari & Chrome into a Keychain data stealer](https://appleinsider.com/articles/26/08/13/fake-github-download-turns-safari-chrome-into-a-keychain-data-stealer)
- [AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS](https://thehackernews.com/2026/08/amnesiastealer-hijacks-chromium.html)
- [AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions](https://www.securityweek.com/amnesiastealer-macos-malware-steals-data-controls-browser-sessions/)
- [New AmnesiaStealer Malware Targets macOS Users via ClickFix Attacks](https://gbhackers.com/new-amnesiastealer-malware-targets-macos-users/)
- [AmnesiaStealer Gives Attackers Live Control of Victims' macOS Browsers](https://securityaffairs.com/197190/malware/amnesiastealer-gives-attackers-live-control-of-victims-macos-browsers.html)
- [Novel macOS Infostealer AmnesiaStealer Spread via ClickFix](https://www.infosecurity-magazine.com/news/macos-infostealer-spread-clickfix/)
- [CVE-2020-9771 Detail](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2020-9771)
- [User Execution: Malicious Copy and Paste, Sub-technique T1204.004](https://attack.mitre.org/techniques/T1204/004/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2029