Jamf Threat Labs has documented a new macOS infostealer that goes beyond credential theft: AmnesiaStealer gives its operators live, hidden control over the victim’s browser session.
The malware spreads through a counterfeit GitHub download page that leans on the ClickFix trick, prompting visitors to paste a Terminal command instead of offering a real download button. The fake page copies GitHub’s dark theme, Octocat logo, and a “Verified Publisher” badge, and the same lure template has been seen in Atomic Stealer and MacSync campaigns, pointing to shared delivery infrastructure.
AmnesiaStealer runs in three stages. A shell script pulls down a Rust infostealer that harvests the keychain, browser data, Apple Notes, and Telegram. A third stage, fetched on command, clones the victim’s browser profile and relaunches it headless so the operator can drive navigation, clicks, and tab management while the real browser window shows nothing unusual.
To unlock the data, the payload shows a native macOS password prompt styled as an Installer dialog, validates the entry locally with dscl, and reuses the captured password to run privileged reads and unlock the login keychain. It sweeps Desktop, Documents, and Downloads for documents and wallet files, and targets 16 Chromium-family browsers for cookies and credentials.
On macOS 26, researchers note a telling behavior: if Chrome’s Safe Storage key cannot be retrieved normally, the malware deletes it and installs its own known key. The security command is not something legitimate browsers use to recreate Safe Storage entries, which gives defenders a reliable tell for spotting the infection.
Persistence arrives as a root LaunchDaemon masquerading as Apple’s crash reporter, and the C2 backend, dubbed Amnesia Panel, returns errors in Russian on failed logins. Jamf rates the stealer as a working collector paired with a functional browser-hijack stage, wrapped in dated but effective bypasses.
