A new and sophisticated malware campaign targeting Mac computers has been uncovered by researchers at Jamf Threat Labs. Known as AmnesiaStealer, this infostealer not only collects passwords and sensitive information, but also allows attackers to quietly take control of a victim’s Chromium-based web browsers in real time.
The attackers use social engineering tricks, relying on fake GitHub pages that encourage users to run a harmful command in their Terminal, making it easy for the malware to slip onto their systems.
Multi-stage attack and data theft
The attack starts when users land on a convincing copy of a GitHub page, complete with a fake ‘Download for macOS’ button. This prompt leads people to copy and paste a command into their Terminal, which then downloads the first stage of the malware.
After the malware is launched, it shows a fake macOS login window to steal the user’s password. With this information, the attackers can unlock and steal sensitive data stored in the Mac’s Keychain, Apple Notes, browser vaults, and the computer’s files.
The malware also targets Safari cookies by exploiting an older security flaw, CVE-2020-9771, which still affects some Macs despite Apple’s patch. To maintain its hold on the system, it installs itself as a background process that resembles Apple’s crash reporting tool. The stolen data is then collected, packed into an archive, and sent back to the attackers’ server.
Complete remote browser hijacking
What sets AmnesiaStealer apart from other Mac malware is its powerful second stage. When instructed by its server, it installs another program that uses the Chrome DevTools Protocol, giving attackers live remote access to the victim’s browser.
This tool quietly launches a hidden browser in the background, turning the infected Mac into a remote-controlled environment. Attackers can use this feature across several Chromium-based browsers, such as Chrome, Brave, Edge, and Opera. By copying the user’s browser profile, a malicious actor can interact with online accounts, including financial and cryptocurrency services, as if they were the user.
Researchers found Russian-language error messages and a unique decryption string in the malware’s server setup, suggesting it was created by Russian-speaking developers and may be used well into 2026. With its ability to steal data and take over browsers, AmnesiaStealer stands out as a serious and growing threat for Mac users.
