Cybersecurity researchers have discovered a sophisticated macOS malware that not only steals sensitive data but also takes control of the victim’s browser sessions. The malware, dubbed AmnesiaStealer, has been spreading through a series of complex attacks, leaving many users unaware of their compromised systems.
AmnesiaStealer is a multi-stage Rust-based information stealer that has been distributed through counterfeit GitHub download pages in recent ClickFix attacks. Once installed, the malware performs reconnaissance on the victim’s system, prompting them to provide their login password and validating it locally. The malware then copies sensitive data such as login keychains, data-protection keys, and browser databases.
The malware also targets six Chromium-based browsers, including Chrome, Brave, Arc, and Edge, by overwriting the per-browser Safe Storage key in the login keychain with an attacker-controlled value. This renders previously saved passwords and cookies unrecoverable, making it impossible for users to recover their sensitive data even if they change their passwords.
One of the most concerning features of AmnesiaStealer is its ability to provide interactive control over the victim’s browser sessions. When the malware receives a remote_stream command, it downloads and runs a stream module that clones the victim’s browser profile and launches it headless. This allows attackers to drive the browser session in real-time using keyboard, mouse, scroll, navigation, and tab management controls.
The researchers note that AmnesiaStealer uses an old TCC bypass (CVE-2020-9771) to steal Safari cookies and access the TCC database. On macOS 26, the attack only works if the Terminal or the malware process already has Full Disk Access. This vulnerability highlights the importance of keeping software up-to-date and ensuring that sensitive permissions are not abused by malicious actors.
AmnesiaStealer’s objectives overlap with other malware families such as Atomic (AMOS), MacSync, and CrashStealer. However, its unique features set it apart from other threats, including a builder-driven configuration and OS version-branched logic that reaches for patched macOS bypasses.
The researchers warn that AmnesiaStealer is a sophisticated threat that requires careful attention to detail to detect and remove. Users are advised to exercise caution when clicking on suspicious links or downloading software from untrusted sources. It’s essential to keep your operating system, browser, and other software up-to-date with the latest security patches to prevent similar attacks in the future.
In conclusion, AmnesiaStealer is a highly sophisticated macOS malware that steals sensitive data and controls browser sessions. Its ability to provide interactive control over victim’s browsers makes it a significant threat to users’ online security. By staying informed about the latest threats and taking necessary precautions, you can protect yourself from similar attacks in the future.
Source: SecurityWeek — 2026-08-14