AmnesiaStealer macOS Malware: How Live Browser Control Elevates Threat

AmnesiaStealer macOS Malware: Live Browser Control Elevates macOS Threat Landscape

macOS has faced numerous stealers—Atomic, MacSync, CrashStealer—often distributed via similar social engineering tactics. The emergence of AmnesiaStealer macOS malware, as detailed by Jamf Threat Labs, represents a significant evolution. It moves beyond passive data theft to establish live, interactive control over active browser sessions. This isn't merely data exfiltration; it enables direct, real-time identity impersonation, necessitating a re-evaluation of macOS defense strategies.

The Attack Chain: Initial Access via Social Engineering

Jamf Threat Labs outlined the attack chain. It begins with social engineering, often a "ClickFix" campaign. Users seeking a utility encounter a convincing, fake GitHub "Download for macOS" page.

The page instructs the user to copy and paste a base64-encoded command into Terminal. This user interaction serves as the critical initial access vector, bypassing many security layers through social engineering.

The base64 command acts as a loader, fetching a dropper script. This script then downloads a password-protected ZIP archive containing the primary payload.

The dropper extracts and executes the AmnesiaStealer macOS malware payload from the ZIP. The payload itself is a Rust-based Mach-O binary, indicating a modern development approach for macOS targeting.

Upon execution, the AmnesiaStealer macOS malware performs basic reconnaissance and mutes system audio. It then presents a native AppKit NSAlert, masquerading as an "Installer wants to make changes" prompt, requesting the macOS password. The malware validates this password against the local directory service via dscl. Incorrect entries trigger a loop; a fallback osascript prompt is used if the native alert fails.

Providing the password grants the malware significant local access. It uses the password to unlock the Keychain (security unlock-keychain -p) and stores it in cleartext within /tmp and ~/.pwd. This cleartext storage is a strong signal for EDR systems to flag.

<figcaption>Base64 command in Terminal: The initial compromise.</figcaption>

Two-Stage Data Exfiltration and Live Control

AmnesiaStealer macOS malware operates in two distinct stages, with the second stage introducing a critical new dimension to the threat.

Stage 1: The Information Stealer

With system password access, the malware initiates its information gathering. Here's what it goes after:

• Keychain Data: All entries from iCloud Keychain.
• Apple Notes: Notes and attachments are targeted.
• Files: General file collection using cat and cp, with duplicate for specific items like Safari cookies, form values, and Notes. It scans Desktop, Documents, and Downloads for .txt, .pdf, .rtf, .doc, .key, .jpg, .png, .csv, and .wallet files.
• Cryptocurrency Wallets: Generic pattern matching identifies browser extensions and IndexedDB data for crypto wallets. A clipper module can be enabled to swap Bitcoin, Ethereum, Monero, and other addresses in the clipboard.
• Telegram Sessions: Active Telegram sessions are also targeted.
• Chromium Browsers: It targets 16 distinct Chromium-based browsers (e.g., Google Chrome, Brave, Arc, Microsoft Edge). It copies the entire Extensions directory, Cookies, Login Data, Web Data, History, Bookmarks, Local State, and Preferences. It attempts to recover master keys by reading Chrome Safe Storage passwords from the Keychain.
• Safari Cookies: On older macOS versions (e.g., Catalina), the AmnesiaStealer macOS malware attempts a TCC bypass (CVE-2020-9771) for Safari cookies. On current macOS versions (e.g., macOS 26 (Tahoe)), this requires Full Disk Access, which the malware typically does not acquire.
• Safe Storage Keys (macOS 26 and above): On macOS 26 and above, if existing Chrome Safe Storage keys can't be recovered, the malware overwrites them with a hardcoded value. This means your old passwords and cookies become unreadable, but the attacker can decrypt any new data stored. This overwrite is a very strong signal for detection.
• Persistence: Persistence is established via a root LaunchDaemon, impersonating Apple's crash reporting service.
• Exfiltration: Collected data is staged in a randomly named directory under /tmp, then archived and exfiltrated to the C2 server, identified by Jamf as debug.allllowef[.]space/send/.

Stage 2: The Live Browser Control (stream_module)

This second stage distinguishes the AmnesiaStealer macOS malware. The C2 server can issue a remote_stream command, prompting the first-stage payload to fetch and execute a second Rust binary from the same infrastructure: the stream_module.

Here's how it operates:

• Profile Cloning: The stream_module clones your browser profile from one of seven Chromium-based browsers (Chrome, Brave, Edge, Arc, Opera, Vivaldi, Chromium).
• Headless Browser: It then launches the legitimate browser executable in a hidden, headless mode. Command-line switches are used to weaken browser defenses, facilitating attacker control.
• WebSocket Relay: Two WebSockets are established. One connects to the attacker's C2 relay, sending JSON registration messages and a 3 frames-per-second screencast of the headless browser session back to the attacker. The second WebSocket connects to the local headless Chromium instance via its webSocketDebuggerUrl, granting the attacker full access to the Chrome DevTools Protocol (CDP).
• Live Control: Through the CDP, the attacker gains full keyboard and mouse inputs. They can navigate websites, click links, type, scroll, manage tabs, and call Network.getAllCookies to export cookies to a Netscape cookie file.
• Stealth: To evade anti-automation measures, the stream_module injects a script to patch several browser fingerprinting APIs, making the headless session appear more like a legitimate user.

This goes far beyond simple cookie theft; it's a "hands-on-keyboard" hidden browser session. The attacker operates your authenticated sessions in real-time, from your own machine, without visible indication.

<figcaption>Remote control: Attacker operating a hidden browser session.</figcaption>

Implications of Live Browser Control: Beyond Data Theft

The AmnesiaStealer macOS malware's real impact goes far beyond your average data breach. It allows for active, real-time identity impersonation, which is a much more immediate and direct danger.

• Financial Fraud: Attackers can access banking portals, initiate fund transfers, or make purchases using existing authenticated sessions. MFA relying on browser context or session cookies may not trigger.
• Email and Social Media Takeover: An attacker can send emails, post on social media, or access sensitive cloud services, all while operating as the legitimate user.
• Undetectable Actions: The use of cloned profiles and patched fingerprinting APIs makes these actions difficult for services to detect as anomalous, bypassing many browser or host-based identifiers.
• Destructive Potential: The overwrite of Safe Storage keys on macOS 26 and above is a serious problem. It doesn't just compromise your data; it also makes your old passwords and cookies permanently inaccessible, all while giving the attacker ongoing access to new information.

While Apple has patched some older bypasses the AmnesiaStealer macOS malware attempts, such as CVE-2020-9771, the core mechanism—tricking a user into executing a command and then exploiting that access for live browser control—remains a potent attack vector.

Defense Strategies Against AmnesiaStealer macOS Malware

Effective defense against AmnesiaStealer macOS malware requires a multi-layered approach. User education is fundamental, as the malware's initial access hinges on a user executing a copied Terminal command. Emphasizing the risks of running arbitrary commands from untrusted online sources is critical, even for technically proficient users.

Endpoint Detection and Response (EDR) solutions are vital here. While traditional antivirus might catch some parts, the AmnesiaStealer macOS malware's multi-stage attack and use of legitimate headless browsers demand behavioral detection. EDR systems should look for things like: unusual dscl activity or repeated password prompts; new LaunchDaemons pretending to be system services; strange process trees (e.g., a browser running headless from an unexpected source); connections to known C2 domains like debug.allllowef[.]space; and cleartext passwords written to ~/.pwd or /tmp.

The overwrite of Safe Storage keys on macOS 26 and above is an especially strong signal against AmnesiaStealer macOS malware.

Maintaining up-to-date browsers is also essential. While the AmnesiaStealer macOS malware leverages the legitimate Chrome DevTools Protocol (CDP), consistent patching helps mitigate other potential browser vulnerabilities it might attempt to exploit, and ensures the latest security features are active.

Threat intelligence and network protection tools that can detect and block known malicious C2 infrastructure are extremely important. Jamf's analysis confirms active tracking by security vendors.

The principle of least privilege, though challenging to enforce on personal machines, still applies. Users should carefully review and restrict applications with Full Disk Access.

AmnesiaStealer macOS malware significantly elevates the macOS threat landscape. Its shift from passive data exfiltration to active, real-time identity impersonation within sensitive online sessions demands an adaptive defense posture. Prioritizing behavioral anomaly detection and robust user education is crucial, as a single user action can now lead to a full session takeover by AmnesiaStealer macOS malware.