AmnesiaStealer – Weekly Pwning Pick

AmnesiaStealer represents a paradigm shift in macOS malware sophistication. Discovered by Jamf Threat Labs on August 13, 2026, this multi-stage Rust-based infostealer combines traditional credential theft with a novel remote-control mechanism that hijacks Chromium browsers in real-time. ## Technical Breakdown The attack chain spans three stages: A shell script dropper fetches the password-protected payload from attacker infrastructure, Stage 1 executes the main Rust infostealer harvesting keychains, browser profiles, and Apple Notes, and Stage 2 deploys a stream_module that clones the victim's Chromium profile and launches a headless browser instance. The stream_module's innovation lies in its abuse of Chrome DevTools Protocol (CDP). After duplicating the victim's browser profile—preserving all authentication cookies and session tokens—the malware launches the legitimate browser in headless mode with weakened defenses. It then establishes a WebSocket channel to the attacker's relay server, giving the operator live screencast control at ~3fps with full keyboard, mouse, and navigation input. This transforms the infected machine into a live, operator-driven portal accessing the victim's authenticated banking, email, and cryptocurrency accounts. ## Exploitation & Delivery Distributed via ClickFix campaigns, victims land on a counterfeit GitHub page (hxxps://github.aoitour[.]com) featuring a fake "Download for macOS" button. The page deceives users into pasting a base64-encoded command into Terminal. The dropper script extracts a password-protected ZIP archive, applies fake Apple code signatures, and strips quarantine attributes to evade Gatekeeper detection. The embedded configuration is encrypted with a 15-byte XOR key (4mn3s1a_2o26!xK), concealing C2 endpoints. The infostealer also attempts two TCC (Transparency, Consent, and Control) bypasses on older macOS versions: APFS snapshot mounting and direct TCC.db injection—both patched on macOS 26 but demonstrating OS-version-branched malware logic. ## Threat Impact What distinguishes AmnesiaStealer from predecessors like Atomic, MacSync, and CrashStealer is the operator-driven browser control. While traditional infostealers copy credentials offline, this malware enables real-time account takeover. An attacker can drain cryptocurrency wallets, execute wire transfers, modify email forwarding rules, or hijack multi-factor authentication all while maintaining the victim's browser fingerprint, IP address, and authentication context. macOS lacks browser-level monitoring that would alert victims to unauthorized remote input. ## Timeline & Scope Discovered August 13, 2026, active in the wild. The malware builder generates per-build configurations and per-request tokens, indicating organized distribution infrastructure. No patch exists—mitigation relies on detection of ClickFix lures and terminal command inspection. ## CVSS & Severity While not a traditional CVE, AmnesiaStealer's combination of infostealing + live remote control + macOS permission bypasses warrants critical-level threat status. The stream_module's CDP abuse is the first documented macOS malware implementing this pattern, making it a benchmark threat for 2026.