New AmnesiaStealer Malware Hijacks Browser Sessions on macOS Devices
A sophisticated piece of malware called AmnesiaStealer has been discovered targeting macOS users through ClickFix attacks. This latest threat allows attackers to hijack browser sessions and interactively control a victim’s web browsing experience, potentially leading to the theft of sensitive information.
The malware works by copying the victim’s Chromium profile, which includes authentication state, and loading it into a hidden, headless browser on the infected system. This allows hackers to access authenticated sessions while preserving identifiers associated with the browser, host, and network. AmnesiaStealer can collect data from 16 different Chromium-based web browsers, including sensitive information such as passwords, cryptocurrency wallets, Apple Notes, and documents.
Researchers at Jamf, an Apple device management and security company, analyzed the malware’s distribution and found that it uses a fake GitHub download page to drop a password-protected ZIP archive. The ClickFix command executes a shell-script loader that downloads and launches the AmnesiaStealer Mach-O payload, which captures the victim’s macOS password and uses it to collect keychain data and other sensitive information.
One of the most notable capabilities of AmnesiaStealer is its stream_module, retrieved using the remote_stream command. This allows malicious operators to remotely control authenticated sessions deployed from a headless browser instance. The module can duplicate user profiles in seven Chromium-based browsers, including Google Chrome, Microsoft Edge, Vivaldi, Arc, Opera, Brave, and Chromium.
The malware establishes two WebSocket channels: one connects to the operator’s relay and sends JSON registration messages containing browser name and build information, while the other connects to the local headless Chromium instance through the browser’s webSocketDebuggerUrl. This provides access to the Chrome DevTools Protocol (CDP), allowing hackers to navigate websites with mouse and keyboard control, export or import cookies, and operate online portals using the victim’s existing authenticated sessions.
Jamf notes that AmnesiaStealer contains a fallback mechanism when it runs on macOS 26, which makes previously stored cookies and passwords permanently unreadable while allowing the attacker to decrypt data later. This is a concerning development, as it suggests that attackers may be able to access sensitive information even if the victim’s browser has been updated.
The combination of AmnesiaStealer’s cloned Chromium profile with CDP-based, live remote control makes this malware particularly insidious. While past malware has abused CDP for command-and-control communications or data theft, AmnesiaStealer appears to be the first documented macOS malware to combine these capabilities.
To protect against AmnesiaStealer and similar threats, users should remain cautious when interacting with unknown downloads or websites. Always verify the authenticity of software and updates, and never click on suspicious links or download attachments from untrusted sources. It’s also essential to keep operating systems and browsers up-to-date, as this will help prevent attacks like these.
In addition, users can take steps to secure their browser profiles by regularly backing up data, using strong passwords, and enabling two-factor authentication whenever possible. By being aware of the potential risks associated with AmnesiaStealer and taking proactive measures to protect themselves, individuals can reduce the likelihood of falling victim to this sophisticated malware.
Source: Bleeping Computer — 2026-08-16