New AmnesiaStealer macOS malware hijacks browsers remotely

A newly identified macOS infostealer is taking browser hijacking to an unprecedented level. Dubbed AmnesiaStealer, this malware doesn’t just quietly siphon credentials; it gives attackers a live, interactive view of your authenticated web sessions and lets them control the browser remotely.

The malware is distributed through ClickFix social engineering campaigns, which use a counterfeit GitHub download page to trick users into opening a password-protected ZIP archive. Once executed, the payload deploys a sophisticated toolkit that can harvest data from 16 different Chromium-based browsers, along with passwords, cryptocurrency wallets, Apple Notes, documents, and even keychain data.

Security researchers at Jamf, a leader in Apple device management, have been tracking this threat. They discovered that AmnesiaStealer reuses a distribution template previously observed in campaigns spreading the Atomic and MacSync infostealers. The ClickFix lure executes a shell-script loader that fetches and runs the malicious archive containing the Mach-O binary.

What sets this malware apart is its streammodule component, which is fetched via a remotestream command. This module allows the attacker to duplicate the victim’s Chromium profile, including its full authentication state, and load it into a hidden headless browser instance on the infected machine. By doing so, the hacker can access active sessions while preserving the original browser, host, and network identifiers.

The technical execution is noteworthy. The module targets seven major Chromium-based browsers: Google Chrome, Microsoft Edge, Vivaldi, Arc, Opera, Brave, and Chromium. Because these browsers share the same DevTools Protocol, launch flags, and cookie encryption, the malware can launch the legitimate browser executable in headless mode with weakened defenses, clone the profile, and specify a storage location for the copied data.

A WebSocket channel is then established to connect with the operator’s relay server. The malware sends a JSON registration message containing browser details, and the operator can issue commands like navigation and mouse clicks. A second WebSocket channel links to the local headless Chromium instance through its webSocketDebuggerUrl, granting full access to the Chrome DevTools Protocol (CDP). This enables the attacker to browse websites, export or import cookies, and interact with online portals using the victim’s authenticated sessions.

Jamf researchers highlight the real-time nature of this attack. “The operator receives a live screencast of the session at around 3fps and can drive it with a full input set: keyboard, mouse, scroll, navigation and tab management,” they explain. “In effect the remote_stream command turns an infected host into a live, operator-driven browser running the victim’s authenticated sessions, which is a materially different level of access from file collection.”

Beyond browser hijacking, AmnesiaStealer exfiltrates cookies, saved logins, browsing history, bookmarks, extensions, and local state data. It also identifies cryptocurrency wallets by enumerating extensions and IndexedDB data. The malware captures the victim’s macOS password to access keychain contents, and it includes a fallback mechanism for macOS 26. If the existing Chrome Safe Storage key cannot be recovered, the malware substitutes an attacker-supplied value, rendering previously stored cookies and passwords unreadable but allowing the attacker to decrypt them later.

While the Chrome DevTools Protocol has been abused before, notably by Chaos ransomware to hide command-and-control traffic and by Chaes malware to enable data theft, AmnesiaStealer marks the first documented macOS malware to combine a cloned Chromium profile with CDP-based live remote control. This hybrid approach gives attackers a powerful tool to interact with authenticated sessions through a hidden browser on the victim’s machine.

To stay protected, users should exercise caution and never execute terminal commands found online unless they fully understand the source and purpose. The threat landscape for macOS is clearly evolving, and this new level of browser control demands heightened vigilance.