AmnesiaStealer is a recently identified malware targeting macOS devices that doesn’t just steal credentials—it grants attackers the ability to take over browsers already open and signed in. Instead of waiting for stolen passwords to be reset, this threat lets hackers exploit active sessions to access email, business tools, crypto accounts, and more, often without detection. ([cybersecuritynews.com](https://cybersecuritynews.com/amnesiastealer-hidden-control/))
How the Attack Works
The infection begins with a social engineering tactic dubbed “ClickFix.” Victims receive a link to a fake GitHub download page, where they’re instructed to paste a command into Terminal. Running that command launches a multi-stage payload built in Rust, removes traces of installation, and initiates data harvesting operations. ([cybersecuritynews.com](https://cybersecuritynews.com/amnesiastealer-hidden-control/))
From there, AmnesiaStealer harvests a wide variety of sensitive data: saved credentials, browser history and bookmarks, Telegram session snapshots, Apple Notes, wallet browser data, and keychain items. ([cybersecuritynews.com](https://cybersecuritynews.com/amnesiastealer-hidden-control/)) During this phase, the malware also tries to extract each browser’s Safe Storage key to decrypt protected data. ([cybersecuritynews.com](https://cybersecuritynews.com/amnesiastealer-hidden-control/))
Silent Control Over Active Browser Sessions
A core innovation of AmnesiaStealer is its second-stage browser streaming module. Once data collection is complete, operators can choose to spawn a hidden, headless Chromium process and load the victim’s browser profile into it. The user’s visible browser stays unchanged, so there’s little immediate clue anything is wrong. This stealth access uses the legitimate Chrome DevTools Protocol to let attackers move through tabs, send keystrokes and mouse clicks, view page content in real time, and navigate through accounts. It works across multiple browsers in the Chromium family. ([cybersecuritynews.com](https://cybersecuritynews.com/amnesiastealer-hidden-control/))
This technique shifts the danger from merely storing and sifting through stolen credentials later to active exploitation in real time—such as navigating to account dashboards, exporting cookies or even reusing them elsewhere—all while the session remains valid. ([cybersecuritynews.com](https://cybersecuritynews.com/amnesiastealer-hidden-control/))
Luring Victims & Avoiding Detection
Rather than exploiting software flaws, this campaign capitalizes on trust. The setup mimics legitimate developer sites and download portals. Victims are told to run Terminal commands that kick off the malware and are later prompted with installer-style dialogs requesting the user’s password. That password is then used locally to unlock the login keychain and extract sensitive materials. Afterwards, persistence is achieved via a disguised LaunchDaemon, and clean-up routines erase initial footprints. ([cybersecuritynews.com](https://cybersecuritynews.com/amnesiastealer-hidden-control/))
Cybersecurity defenders are urged to stay alert for unusual system behaviors such as unexpected Terminal commands, unauthorized access to browser profiles, hidden Chromium processes, or anything masquerading as native Apple system services. These signs tend to be more reliable than simply watching for file signatures. ([cybersecuritynews.com](https://cybersecuritynews.com/amnesiastealer-hidden-control/))
Indicators of compromise include a specific SHA-256 hash—1edb978783394b946ee6d27510564aa56af1f033b08e2b90fa2c35bc4f495a93—which maps to a known sample of AmnesiaStealer. ([cybersecuritynews.com](https://cybersecuritynews.com/amnesiastealer-hidden-control/))
Organizations should integrate threat intelligence into their monitoring systems and enable behavior-based detection. Watching for delivery chains like ClickFix and anomalies in privileged operations can help catch attacks earlier. ([cybersecuritynews.com](https://cybersecuritynews.com/amnesiastealer-hidden-control/))
This attack marks a noticeable shift in macOS malware strategy—from simple credential sweeps toward live, interactive compromise of trusted sessions. By taking over authenticated browser windows, attackers can bypass many layers of defense that usually protect against credential reuse or forced resets.
