AmnesiaStealer malware grants attackers live control of macOS browser sessions

Key points

• AmnesiaStealer is distributed via fake GitHub pages that instruct users to paste commands into Terminal, a technique known as ClickFix.
• The malware captures the victim's macOS login password to unlock Keychain data, Apple Notes, and Telegram sessions.
• It targets 16 Chromium-based browsers for data theft and 7 specific browsers for live remote control.
• The stream_module launches a headless browser with the victim's profile, allowing attackers to navigate sites using existing authenticated sessions.
• Attackers receive a live screencast at approximately 3 frames per second and can control the browser via keyboard, mouse, and navigation commands.

Background

This incident follows a pattern of sophisticated macOS malware campaigns observed in 2026, such as the Monero miner exploiting Screen Sharing flaws and various ClickFix infostealers like Atomic and MacSync. While previous threats focused on data exfiltration or cryptocurrency mining, AmnesiaStealer introduces interactive session hijacking, marking a shift toward real-time operational control on macOS endpoints.

How outlets are covering it

Jamf Threat Labs emphasizes the unique capability of AmnesiaStealer to combine data theft with live browser control, noting that the stream_module turns infected hosts into operator-driven browsers. The Hacker News highlights the malware's use of the Chrome DevTools Protocol and its ability to patch browser fingerprinting APIs to avoid detection. AppleInsider notes that while some macOS bypasses failed on newer versions, the core collection and browser hijacking remained effective. All sources agree that the ClickFix distribution method relies on user error, but Jamf and AppleInsider stress that the interactive control represents a materially different threat level compared to traditional infostealers.

Why it matters

AmnesiaStealer demonstrates a new attack vector where malware does not just steal static data but actively operates within authenticated sessions. This bypasses many security measures that rely on password changes or session timeouts, as the attacker uses the victim's existing cookies and session identifiers. The ability to control a hidden browser in real-time allows for complex actions like multi-factor authentication bypass or financial transactions, posing a significant risk to users and enterprises.

What to watch

Security teams should monitor for indicators of compromise associated with AmnesiaStealer, including specific domains and file hashes. Users are advised to avoid executing unknown commands in Terminal and to keep macOS updated, as Apple has patched several bypass techniques used by the malware. If infection is suspected, users should disconnect from the network, change passwords from a trusted device, and consider reinstalling macOS to ensure complete removal.