AmnesiaStealer drives your own browser, so session theft is the real macOS loss

Jamf Threat Labs published an analysis on 13 August 2026 of AmnesiaStealer, a multi-stage Rust infostealer for macOS that arrives through a fake GitHub ClickFix page and ends with the operator remotely driving the victim's own Chromium browser ^[1][2]. The consequence for incident response is narrow and unpleasant: the payload exports live cookies in plain text and can import them into a session elsewhere, so a password reset closes the door the malware already walked through and leaves the one it built ^[14][22].

The delivery is unremarkable and effective. The fake page instructs the user to paste a command into Terminal; `curl` pulls a shell script that is run under `nohup bash`, a ZIP protected with the password `dulin` lands in `/tmp`, and the extracted Rust universal Mach-O binary is cleared with `xattr -cr`, made executable, and given an ad-hoc signature before launch ^[3][4][5]. Temporary files and shell history are then deleted ^[6]. A native-looking dialog asks for the macOS login password, which the malware validates locally with `dscl` or `sudo -S -v`, writes in clear text to its staging area and to `~/.pwd`, and uses to attempt a Keychain unlock ^[7][8]. Collection covers Keychain data, Apple Notes, Telegram, documents, 16 types of Chromium profile, crypto wallets and system information, archived from a `/tmp/<25 characters>` folder with `ditto` and posted to the C2 at `/send/` ^[9][10]. The stolen password also buys a root LaunchDaemon named `com.apple.ReportCrash.agent_<digits>` ^[11].

Stage 2 is where the containment model breaks. On the C2 command `remote_stream`, an extra `stream_module` is downloaded, the victim's Chromium profile is copied to `~/.local/share/.stream/profiles/<browser>`, and the genuine browser is launched headless with remote debugging enabled ^[12][13]. The operator then works through a WebSocket relay and Chrome DevTools Protocol, controlling tabs, mouse, keyboard and navigation, exporting cookies with `Network.getAllCookies` and re-injecting them with `Network.setCookies` ^[14][15]. Because that activity runs inside a legitimate browser process on the victim's machine, Jamf notes that identity providers may read it as an ordinary session from the victim's device and IP ^[16]. Rotating the password does not invalidate an already-exported cookie; only session revocation does ^[22][17].

Two other details matter operationally. Privilege escalation to TCC-protected data is not a given: the malware tries CVE-2020-9771 and TCC database injection, and in Jamf's testing on macOS 26 that fails without Full Disk Access, with the source noting that root and Full Disk Access remain separate and that public reporting does not claim root alone yields TCC data ^[18][19]. And the Chrome Safe Storage fallback is destructive rather than stealthy: if the key cannot be obtained, the malware deletes existing items and recreates them with a known password, which can permanently break decryption of previously saved data ^[20].

Watch the detection surface Jamf lists: Terminal-spawned `curl`/`bash`, `/tmp/.com.apple.dt.*`, ad-hoc signatures, new LaunchDaemons, unknown C2 traffic and headless browsers with remote debugging ^[21]. On macOS 26, use of the `security` CLI to delete and recreate Chrome Safe Storage is called out as a strong anomaly signal ^[23]. If any of those fire, the first action is session revocation across the identity provider, not a password change ^[17].