\n<\/p>\n
A new and sophisticated malware campaign targeting Mac computers has been uncovered by researchers at Jamf Threat Labs. Known as AmnesiaStealer, this infostealer not only collects passwords and sensitive information, but also allows attackers to quietly take control of a victim\u2019s Chromium-based web browsers in real time.<\/strong><\/p>\n The attackers use social engineering tricks, relying on fake GitHub pages that encourage users to run a harmful command in their Terminal, making it easy for the malware to slip onto their systems.<\/span><\/p>\n The attack starts when users land on a convincing copy of a GitHub page, complete with a fake \u2018Download for macOS\u2019 button. This prompt leads people to copy and paste a command into their Terminal, which then downloads the first stage of the malware.<\/span><\/p>\n After the malware is launched, it shows a fake macOS login window to steal the user\u2019s password. With this information, the attackers can unlock and steal sensitive data stored in the Mac\u2019s Keychain, Apple Notes, browser vaults, and the computer\u2019s files.<\/span><\/p>\n The malware also targets Safari cookies by exploiting an older security flaw, CVE-2020-9771, which still affects some Macs despite Apple\u2019s patch. To maintain its hold on the system, it installs itself as a background process that resembles Apple\u2019s crash reporting tool. The stolen data is then collected, packed into an archive, and sent back to the attackers\u2019 server.<\/span><\/p>\n What sets AmnesiaStealer apart from other Mac malware is its powerful second stage. When instructed by its server, it installs another program that uses the Chrome DevTools Protocol, giving attackers live remote access to the victim\u2019s browser.<\/span><\/p>\n This tool quietly launches a hidden browser in the background, turning the infected Mac into a remote-controlled environment. Attackers can use this feature across several Chromium-based browsers, such as Chrome, Brave, Edge, and Opera. By copying the user\u2019s browser profile, a malicious actor can interact with online accounts, including financial and cryptocurrency services, as if they were the user.<\/span><\/p>\n Researchers found Russian-language error messages and a unique decryption string in the malware\u2019s server setup, suggesting it was created by Russian-speaking developers and may be used well into 2026. With its ability to steal data and take over browsers, AmnesiaStealer stands out as a serious and growing threat for Mac users.<\/span><\/p>\nMulti-stage attack and data theft<\/b><\/h3>\n
Complete remote browser hijacking<\/b><\/h3>\n