The newly discovered AmnesiaStealer malware targeting macOS demonstrates an important evolution in information-stealing malware: attackers increasingly want control over an authenticated browser rather than merely a database of stolen passwords. Jamf Threat Labs identified the Rust-based malware being distributed through ClickFix social engineering, where victims are directed to a counterfeit GitHub download page and instructed to paste a command into Terminal to install what they believe is legitimate software. Once executed, AmnesiaStealer can collect passwords, Keychain information, Chromium browser data, Safari cookies and other sensitive files. More unusually, however, the malware can download a separate streaming module that clones the victim’s Chromium browser profile and launches a hidden browser session that the attacker can operate remotely. This means the attacker is no longer limited to stealing authentication information for later use but can effectively sit inside the victim’s authenticated web environment and interact with services through sessions the user has already established. 

That capability is significant because modern authentication has become much harder to defeat by stealing passwords alone. Enterprises increasingly use multi-factor authentication, passkeys, device recognition, conditional access and behavioural controls that may prevent a criminal from simply taking a username and password and signing in from an unfamiliar computer. Session cookies change that equation because they represent the authenticated state created after the user has already completed those security checks. If malware can reuse the victim’s existing browser profile or operate a cloned session containing valid authentication state, the attacker may be able to reach services without repeating the original login sequence. MFA can therefore work exactly as intended while the resulting trusted session is subsequently hijacked.

AmnesiaStealer takes this approach further by providing interactive control rather than merely copying cookies into a file. Jamf found that its optional remote-streaming component uses the Chrome DevTools Protocol to operate a headless Chromium browser containing a cloned version of the victim’s profile. The attacker receives a low-frame-rate live view of the browser and can perform keyboard input, mouse actions, scrolling, navigation and tab management remotely. This creates what is effectively a hidden second browser running on the victim’s Mac, where the criminal can manually interact with websites using the authentication context available in the stolen profile.

Interactive browser control has several advantages for attackers. A stolen cookie exported to another computer may trigger anti-fraud systems because the session suddenly appears from a new device, operating system or network location. Running the cloned browser directly on the compromised Mac preserves much more of the victim’s local context. The activity may originate from the same machine and internet connection the service already associates with the legitimate user, making device-based or geographic anomaly detection considerably less reliable. Rather than transporting the credential to the attacker, the attacker transports their actions to the credential.

This represents a broader shift in credential theft. Security teams have traditionally thought about malware stealing passwords, browser databases or session cookies and then uploading those artifacts to a criminal marketplace. Modern malware increasingly treats the browser itself as the valuable asset. A browser may contain authenticated sessions for Microsoft 365, Google Workspace, cloud consoles, CRM platforms, GitHub, banking services and numerous other applications simultaneously. Taking control of that environment can therefore provide access to multiple services without needing to defeat each organization’s authentication system independently.

For enterprise users, this creates particular risk because cloud applications have become the primary workplace. An employee’s browser may simultaneously contain access to email, collaboration platforms, HR applications, customer information and internal administrative tools. If the infected Mac belongs to a developer or administrator, browser sessions may also provide access to source repositories, cloud infrastructure or security-management systems. Compromise of one endpoint can therefore become compromise of several SaaS identities even though none of those services contains a vulnerability.

This is why organizations should not consider successful MFA the end of the authentication problem. Session lifetime, device binding and continuous authentication become increasingly important once attackers target post-authentication state. Sensitive applications should evaluate whether a session suddenly behaves differently, even when the cookie remains technically valid. Large downloads, creation of new authentication methods, unexpected OAuth authorization, unusual administrative actions or access to previously unused applications should generate risk signals independently of whether the session originated from a known device.

High-risk actions should also require fresh authentication rather than trusting an old browser session indefinitely. Creating an API token, changing MFA settings, adding a recovery method, exporting large datasets or modifying financial information can require the user to prove possession of a phishing-resistant factor again. This limits what an attacker can accomplish with a hijacked session when the original password or hardware-backed credential is unavailable.

The delivery mechanism is equally instructive because AmnesiaStealer uses ClickFix rather than exploiting a macOS vulnerability for initial execution. Victims encounter a counterfeit GitHub-style page that tells them to copy and paste a Base64-encoded command into Terminal. That command downloads a script, retrieves a password-protected archive and executes the malware. The user therefore performs the critical execution step themselves, allowing the campaign to bypass many browser protections that would normally prevent a downloaded application from launching automatically.

ClickFix attacks have become effective precisely because they disguise command execution as troubleshooting. Users have been trained to distrust suspicious attachments, but many are considerably less cautious when a website says that a problem can be fixed by copying one command into Terminal or PowerShell. The command may appear technical and therefore legitimate, particularly when the page convincingly imitates GitHub or another familiar technology service. The attacker effectively converts the victim into the execution engine.

Organizations should therefore treat instructions to paste commands into Terminal as equivalent to being asked to run an unknown executable. The shell is not a safer installation mechanism simply because the malicious instructions arrive as text. In many cases it is more dangerous because a copied command can download, modify and execute multiple payloads while displaying almost nothing to the user. Security awareness should explicitly address ClickFix-style instructions rather than assuming employees automatically understand the consequences of terminal commands.

Managed macOS environments can reduce this risk through application control, web filtering and behavioural endpoint detection. Unexpected Terminal activity initiated immediately after visiting a newly registered or suspicious domain should receive attention, particularly when the shell launches `curl`, downloads archives, modifies executable permissions or starts unsigned binaries from temporary directories. These behaviours remain useful detection opportunities even when the exact AmnesiaStealer hash or distribution domain changes.

AmnesiaStealer also demonstrates that macOS should no longer be treated as an inherently low-risk endpoint simply because historical malware volume has been higher on Windows. Macs are increasingly used by developers, executives, creative teams and technology staff who may have access to highly valuable cloud services. Criminal groups follow those users because the potential return from compromising one privileged Mac can easily justify developing platform-specific malware.

The malware attempts to collect macOS Keychain information in addition to browser data. Keychain is designed to provide secure credential storage for legitimate applications, but malware executing with sufficient user authority may attempt to manipulate system utilities or persuade the user to provide additional access. This highlights an important limitation of secure credential storage: protecting a secret while the system is locked is different from protecting it when malicious software is operating inside the user’s active session.

AmnesiaStealer also attempts to obtain the user’s macOS login password through social engineering. Malware can use that password to expand what it can access and to support privileged operations. Users should therefore be particularly suspicious when software installed from an unfamiliar source suddenly asks for their Mac password. Legitimate administrative prompts are common enough on macOS that attackers deliberately imitate them, making application provenance critical to deciding whether a password request should be trusted.

Jamf found that the malware attempts to bypass Apple’s Transparency, Consent and Control protections to access Safari cookies and other protected resources. One technique references CVE-2020-9771, an older vulnerability that Apple has long since corrected. On modern macOS versions the bypass does not simply defeat current TCC protections universally, and some access still depends upon permissions already granted to the relevant process. This is another reason security commentary should distinguish between malware attempting a bypass and successfully bypassing every fully patched Mac configuration.

Keeping macOS current therefore remains valuable even when the initial infection uses social engineering. Attackers frequently combine user-assisted execution with older local vulnerabilities, permission abuse and configuration weaknesses to expand access after installation. An updated operating system removes many of those secondary opportunities and forces the malware to depend more heavily upon convincing the user to grant privileges directly.

Full Disk Access should also be assigned very sparingly. Terminal applications, script interpreters and general-purpose tools become substantially more dangerous if they possess broad access to protected user data because any command executed through them may inherit those privileges. Organizations should periodically review which applications have Full Disk Access and remove permissions that are no longer operationally required.

The malware’s persistence mechanism provides another detection opportunity. AmnesiaStealer installs a LaunchDaemon so that its components can survive reboots and continue operating after the initial execution. macOS security monitoring should therefore watch for unexpected LaunchAgents and LaunchDaemons, particularly when newly created persistence entries point toward unusual executables in temporary or user-controlled locations. Persistence creation shortly after command-line downloads is an especially useful behavioural correlation.

The browser-control module also illustrates why the Chrome DevTools Protocol deserves attention from endpoint security teams. CDP is a legitimate developer and automation interface used for browser testing, debugging and tools such as Selenium. It can also provide powerful control over browser tabs, cookies, navigation and page content. A browser unexpectedly being launched with remote-debugging options by an unfamiliar process should therefore be treated as a potentially high-risk event on systems where such behaviour is not part of normal development workflows.

Development environments complicate this detection because developers legitimately use browser automation and debugging features frequently. Security tools therefore need context rather than simply blocking Chrome DevTools functionality globally. The initiating process, browser profile, executable path, user role and network communication surrounding the event can help distinguish legitimate automation from malware-created hidden browser sessions.

Browser-profile cloning should also become a stronger detection signal. Normal applications rarely need to copy an entire Chromium profile into another temporary location and then launch a hidden browser against that copy. File-monitoring and behavioural endpoint controls can detect rapid access to browser cookie databases, login data and profile files followed by creation of a second browser instance.

Organizations should consider reducing session persistence for sensitive applications. Extremely long-lived browser sessions improve usability but provide attackers with more valuable artifacts when endpoints are compromised. Session expiration should reflect application sensitivity, while higher-risk applications can require periodic reauthentication even on known devices.

Device-bound session technologies can make theft more difficult by cryptographically tying authentication state to a device key that cannot simply be copied with the browser database. Industry efforts toward device-bound session credentials and hardware-backed authentication are increasingly relevant because cookie theft has become one of the primary methods for bypassing MFA. The objective is to make possession of the browser cookie alone insufficient to recreate the authenticated session elsewhere.

AmnesiaStealer’s hidden-browser technique shows that device binding cannot solve every scenario, however, because malware operating directly on the original device may still use the legitimate device context. This is why endpoint integrity remains inseparable from identity security. Strong authentication cannot compensate fully for a workstation that has already become attacker-controlled.

Enterprises should therefore combine endpoint detection with identity analytics. If EDR detects suspicious browser cloning or Terminal execution on a Mac, identity systems should immediately increase risk associated with cloud sessions originating from that endpoint. Conversely, unusual SaaS behaviour may provide a reason to inspect the associated device even when endpoint security has not generated an alert. Correlating these two layers creates far stronger detection than treating them independently.

Incident response after confirmed AmnesiaStealer infection should assume that browser sessions and locally available credentials may have been compromised. Simply deleting the malware is insufficient because attackers may already possess session information or have created persistence within online accounts. Security teams should isolate the endpoint, preserve relevant forensic evidence, revoke active cloud sessions and review high-value accounts for unauthorized activity.

Passwords and authentication factors should be changed from a known-clean device rather than from the infected Mac. Changing credentials while the stealer remains active may simply provide the attacker with the replacement information. Existing OAuth grants, API tokens and recovery methods should also be reviewed because attackers controlling an authenticated browser may create persistent cloud access that survives a password reset.

Highly privileged browser sessions deserve additional scrutiny. Cloud administrators, GitHub maintainers, finance users and executives may have authenticated access capable of producing consequences far beyond the local endpoint. Logs should be examined for new tokens, administrative changes, unusual exports and activity occurring during the infection window, including actions that technically originated from the victim’s normal IP address.

Where sensitive or privileged access was present, rebuilding the Mac from a trusted image may provide greater assurance than trying to remove individual malware components. AmnesiaStealer is multi-stage and can retrieve additional modules dynamically, meaning defenders may not know every payload that executed. Reinstallation followed by controlled restoration of user data creates a clearer trust boundary than assuming that deleting one observed binary eliminates the complete intrusion.

The malware also reinforces the importance of password managers and hardware-backed authentication, although neither should be treated as absolute protection once the endpoint is compromised. Password managers can reduce credential reuse and make phishing harder, while passkeys prevent many conventional credential-stealing attacks. But an attacker controlling an authenticated browser may not need to learn the underlying password at all. The security objective must therefore extend from protecting credentials to protecting the authenticated environment in which those credentials are used.

This is perhaps the broader lesson from AmnesiaStealer. Authentication security has improved significantly, and attackers are adapting accordingly. When stealing a password becomes inconvenient because MFA stands behind it, criminals steal the session created after MFA. When copying that session to another computer risks triggering device detection, they operate the victim’s own browser remotely instead.

The defensive model must evolve in the same direction. Protecting passwords remains necessary, but organizations increasingly need to protect browser state, endpoint integrity, session behaviour and cloud authorization after authentication has already succeeded.

For macOS users, the practical protection begins with avoiding ClickFix instructions that request Terminal commands, installing applications only from verified sources, keeping macOS current and treating unexpected permission or password prompts cautiously. For enterprises, the stronger response is managed application control, endpoint behavioural monitoring, restricted Full Disk Access, device-aware conditional access and rapid session revocation when an endpoint is suspected of compromise.

A new information-stealing malware called AmnesiaStealer, which targets macOS users via ClickFix attacks, includes a streaming module that allows the attacker to interactively control the victim's web browser. [...]

Source: New AmnesiaStealer macOS malware hijacks browser sessions via remote control via Bleeping Computer — published 16 Aug 2026.