AmnesiaStealer hijacks live macOS browser sessions, not just saved passwords

Most macOS stealers are smash-and-grab: they scrape your keychain and browser passwords, ship the loot, and leave. AmnesiaStealer, disclosed this week by Jamf Threat Labs, does that too, then keeps going. Its third stage clones your browser profile, launches the real browser hidden in the background, and hands the operator a live view of the session you are already logged into. That single design choice moves the theft from the credential layer to the session layer, and it changes what recovery has to look like.

If the attacker is driving a session you already authenticated, your password is beside the point. So is multi-factor authentication, and so is a passkey. None of those gate an operator who never has to log in because they are riding the tab you left open.

What AmnesiaStealer is

AmnesiaStealer is a multi-stage macOS infostealer written in Rust. Jamf reports it spreads through counterfeit GitHub "Download for macOS" pages that copy the real GitHub styling, logos, and a "Verified Publisher" badge, then, instead of offering a download, tell the visitor to paste a command into Terminal. That lure is the ClickFix technique, and Jamf notes the same delivery template has carried Atomic (AMOS) and MacSync before it.

The chain runs in three parts. A shell script pulls down and starts the payload. A Rust collector then sweeps both keychains, the profile data of 16 Chromium-family browsers, Apple Notes, Telegram sessions, wallet extensions, and files sitting in the Desktop, Documents, and Downloads folders. To reach what it cannot read outright, it throws a native macOS prompt dressed up as an installer dialog, checks the typed password locally with dscl, writes it in cleartext to ~/.pwd, and reuses it to run sudo and open the keychain. The third stage, a browser-control module, is fetched only on command.

The live browser takeover is the real escalation

The third stage is what separates this from the usual Mac stealer. According to Jamf, it copies the victim's existing browser profile into a hidden directory, launches the browser's real binary in headless mode with remote debugging enabled, and controls it over the Chrome DevTools Protocol, the same interface developers use to automate browsers. The operator watches it as a low-frame-rate feed, about three frames a second, with full keyboard and mouse control and cookies pulled straight from the running browser. A stealth script rewrites the browser's fingerprinting APIs so the sites being visited never flag the session as automated.

We wrote about the same session-layer shift in ACR Stealer: once an attacker holds a live, authenticated session, a password reset is necessary but not sufficient. Rotating the credential closes the front door the attacker never used. To actually evict them you have to invalidate the sessions and cookies they are holding, which means server-side session revocation and, for high-value accounts, forcing every device to re-authenticate. Treat a confirmed AmnesiaStealer hit as a session-compromise incident, not a password-reset ticket.

The Safe Storage rewrite is a backdoor into future passwords

One detail deserves more attention than the coverage gave it. Chrome guards its saved passwords behind a Safe Storage key, and AmnesiaStealer goes after that key first. Normally it lifts the value out of the login keychain. When that route is closed on newer builds, Jamf found the malware turns destructive: it overwrites the key with one the operator chose in advance. Every password already saved in that profile becomes permanently undecryptable, while anything saved from then on decrypts cleanly for the attacker.

That is not a one-time grab. It is durable access to every password the browser saves next, on a machine the user thinks they cleaned up. A host that hit this needs its browser profile rebuilt, not just its passwords rotated, or the operator keeps a decryption key to future secrets long after the malware binary is gone.

Apple's hardening worked, so the attack moved to the human

The most useful thing in the Jamf writeup is what did not work. AmnesiaStealer carries version-branched logic that tries older privilege tricks and gives up when the OS blocks them. One branch reaches for the 2020-era CVE-2020-9771, mounting an APFS snapshot to get at protected files; on current releases the Full Disk Access rules shut it down. Another tries to write itself a Full Disk Access grant straight into the TCC database, and that fails too. The malware's own debug strings concede the point: TCC now walls off the Safari container completely, out of reach even to root. Apple's platform hardening is holding at the OS layer.

Read the table top to bottom and the strategy is obvious. The technical bypasses are blocked; the two things that still work are the destructive Safe Storage rewrite and the ClickFix lure. The operators did not find a new kernel bug. They moved the ask to the person at the keyboard, because a user who pastes a command into Terminal voluntarily hands over the execution that TCC and Gatekeeper are built to withhold. On a hardened Mac the remaining attack surface is largely social, which is why the control that matters most here is not another patch. It is blocking or flagging unsanctioned Terminal-paste execution and teaching users that a real download never asks for one. We made the same point about the lure being the wrong thing to chase in our look at ClickFix as shared infrastructure.

Reset the browser profile, not just the password

AmnesiaStealer leaves behind high-fidelity signals, and most of them have no benign explanation. Jamf's own guidance is blunt on one: a process invoking the security binary to delete or rewrite a Chrome Safe Storage entry is not something legitimate software does. Two more are worth putting in front of your endpoint telemetry today:

• A browser binary launched headless with a --remote-debugging-port against a cloned copy of a live profile. Real users do not run their daily browser this way.

• A root LaunchDaemon impersonating Apple's crash reporter (a com.apple.ReportCrash.agent-style name with a random numeric suffix) that is configured to survive reboots. It is the persistence, and it is the cleanup anchor.

For the response itself: revoke the account's sessions server-side, force re-authentication, and rebuild the affected browser profile rather than trusting a cleaned one. This is the kind of behavior that managed detection is meant to surface, because the individual commands look ordinary and only the sequence gives it away. AmnesiaStealer follows CrashStealer and ClickLock as the third recent Mac stealer built around social consent rather than a software flaw. The pattern is the story: as the OS closes the technical doors, the fastest path in is convincing you to open one.