AmnesiaStealer trades smash-and-grab for a live seat in the victim's browser

Jamf Threat Labs has documented AmnesiaStealer, a three-stage Rust infostealer for macOS delivered through a counterfeit GitHub download page that asks the visitor to paste a base64-encoded command into Terminal ^[1][3][6]. The part that should change how defenders think about macOS stealers is the third stage: on a `remote_stream` command from the operator panel, the malware returns a module that gives hidden, interactive control of the victim's Chromium browser over the Chrome DevTools Protocol ^[19].

The delivery is ClickFix, and the lure is well built: GitHub's dark theme, the Octocat logo, a "Verified Publisher" badge, and a "Terminal installation" box framed as a convenience for advanced users in place of a download button ^[4]. Jamf reports the same template has appeared in Atomic Stealer and MacSync campaigns, so the lure infrastructure is shared across families ^[5]. The pasted command pulls a short, silent, self-deleting script that fetches a password-protected ZIP and runs the payload from it ^[3]. Infosecurity Magazine, citing the Jamf report published on 13 August, notes ClickFix works precisely because the victim types the command themselves, which many defensive tools read as legitimate activity ^[28][c29b].

Then the craft. The Rust payload throws an AppKit NSAlert reading "Installer wants to make changes", validates the entered password locally against the directory service with `dscl`, and loops on "Incorrect password. Please try again" until it gets a real one ^[7][8]. That password is then reused: piped into `sudo -S`, passed to `security unlock-keychain -p`, and written to disk in cleartext as `pwd` in the staging directory and `~/.pwd` in the home folder ^[9]. Before collection starts, the malware mutes system audio, because part of the theft runs through Finder, which plays a sound on every file it duplicates ^[10]. Collection mostly uses `cat` and `cp`, but `duplicate` handles Safari cookies, Notes attachments, Safari Form Values, `~/Library/Keychains/<hardware UUID>` and any Notes `cat` missed ^[11]. As Jamf's Thijs Xhaflaire put it, making Finder the reading process reaches data the malware cannot touch directly without a prompt, and the Safari cookie step tries `cat` first, falling back to `duplicate` only on failure ^[12].

Not everything lands. One Safari cookie fallback is an APFS snapshot bypass built on CVE-2020-9771, patched in Catalina 10.15.4 and 10.15.5, which now works only where Terminal or the malware already holds Full Disk Access ^[16]. The developer's own debugging comments record "no keys recovered" for browser Safe Storage on macOS 26 and later, so the fallback overwrites the Safe Storage password with a hardcoded value, breaking decryption of previously stored credentials and cookies ^[17]. Jamf calls that sequence a high-value detection, since browsers create Safe Storage entries through the Security framework and never through the `security` binary ^[18].

The stream module clones the victim profile, launches it headless, and relays operator input and a 3 FPS screencast over two WebSockets, leaving the visible browser window unchanged ^[20][33]. It pulls cookies in plaintext via `Network.getAllCookies`, bypassing at-rest encryption entirely, and injects a stealth script through `Page.addScriptToEvaluateOnNewDocument` to keep visited sites from flagging automation ^[21][22]. Persistence is a root LaunchDaemon posing as `com.apple.ReportCrash.agent` with a random numeric suffix ^[23].

Watch the operation, not the sample. The panel is branded Amnesia Panel, returns Russian errors on failed login, and sits behind a repeated `/d/command?t=token&b=build` pattern across domains resolving to one address, consistent with a builder issuing per-campaign configs as XOR-encrypted blobs ^[24][25]. Watch too which browsers get covered: at-rest theft hits 16 Chromium browsers, live control only seven, nine fewer ^[15][19][1].