Cybersecurity analysts have found a new macOS malware that not only steals users’ sensitive data but also gets remote access to the victim’s browser sessions.
Known as “AmnesiaStealer” by Jamf Threat Labs, the multi-stage malware spreads via a counterfeit GitHun download page that is similar to the platform’s dark theme and also mimics the “verified publisher” branding. This fake page tricks users into copying and pasting malicious terminal commands rather than downloading an actual application.
This Rust-based malware follows a three-stage infection chain. When executed, it prompts users for their login password and then accesses data from macOS keychain, Chromium-based browsers, Apple Notes, and Telegram. Then it bypasses Apple’s TCC framework and gets access to Safari cookies and full disk access.
Another prominent component is “stream_module.” When it is activated by command-and-control servers, this module mimics the victim’s Chromium browser profile and launches it headlessly, offering attackers interactive control via Chrome DevTools Protocol. This enables operators to view the session in real-time and send keyboard, mouse, and navigation commands.
Moreover, the malware can attack six Chromium-based browsers, including Chrome, Brave, Arc, and Edge.
2026-08-17 23:14:00
