AmnesiaStealer turns a pasted Terminal command into a live remote browser session on macOS

Jamf reports a multi-stage, Rust-based macOS information stealer, AmnesiaStealer, distributed through a counterfeit GitHub download page in recent ClickFix attacks ^[1]. The fake page's only job is to get a victim to paste a command into Terminal, and what lands afterward includes a module that gives the operator interactive control of the browser rather than a one-shot credential dump ^[2][3].

The chain runs in three stages, according to Jamf: a shell script fetches and executes the payload, the stealer harvests data, and a third module is run on command to provide interactive control over the victim's browser ^[3]. Jamf places the family's objectives alongside Atomic (AMOS), MacSync and CrashStealer, and names three traits that separate it: builder-driven configuration, OS version-branched logic that reaches for patched macOS bypasses, and the remote-control second stage ^[4]. That is the part worth internalising. A builder means variants, and version-branched logic means the malware is written by someone who read the platform release notes.

Collection is broad and mostly familiar. After execution the malware performs reconnaissance, prompts the user for their login password and validates it locally, copies the login and data-protection keychains, and harvests Chromium-based browser databases, Apple Notes and documents ^[5]. It attempts two Transparency, Consent, and Control bypasses for Safari cookie and full disk access, archives the loot for the command-and-control server, and installs a LaunchDaemon for persistence ^[6]. Six Chromium-based browsers are targeted, including Chrome, Brave, Arc and Edge ^[7].

The destructive detail is the one defenders can act on. Jamf saw the malware overwrite the per-browser Safe Storage key in the login keychain with an attacker-controlled value, rendering previously saved passwords and cookies unrecoverable ^[8]. Jamf's reading: unable to recover the existing key on macOS 26, the malware swaps the victim's saved data for a key the operator already knows, so anything encrypted afterward can be decrypted operator-side ^[9]. Users notice when their saved logins stop working, which makes the help desk queue a detection channel here.

For Safari cookies and the TCC database, the malware uses an old bypass, CVE-2020-9771 ^[10]. On macOS 26, Jamf says that path works only if the Terminal or the malware process already holds Full Disk Access ^[11]. Put the delivery route and that precondition together and the exposure is clear: pre-granted Full Disk Access on Terminal is what converts a long-patched bug into a working one ^[12].

The second stage is the novelty. On a remote_stream command the malware downloads and runs a stream module that clones the victim's browser profile and launches it headless, giving the attacker control of the session ^[13], via the Chrome DevTools Protocol and a relay channel ^[14]. Jamf describes a live screencast at around 3fps driven with keyboard, mouse, scroll, navigation and tab management translated into CDP calls in real time, and calls it a hands-on-keyboard hidden browser session rather than an automated dump ^[15]. Roughly one frame every 333 milliseconds is enough for a human to click through an MFA prompt inside an already-authenticated profile ^[16].

What to watch: LaunchDaemon writes that follow interactive Terminal activity ^[6], headless browser processes started with remote debugging enabled ^[14], modifications to Safe Storage keychain items ^[8], and how many Macs in your fleet have handed Terminal Full Disk Access ^[11]. Builder-driven kits shed hashes quickly ^[4], so detections keyed to behaviour will outlive detections keyed to samples.