--- title: AmnesiaStealer: macOS malware that hijacks live browser... description: Jamf Threat Labs has documented AmnesiaStealer, a Rust-based macOS infostealer that goes beyond typical credential theft. Delivered via a ClickFix-style fake... canonical: https://daily.dev/posts/amnesiastealer-macos-malware-that-hijacks-live-browser-sessions-not-just-passwords-ar2res3yc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AmnesiaStealer: macOS malware that hijacks live browser sessions, not just passwords | daily.dev og:description: Jamf Threat Labs has documented AmnesiaStealer, a Rust-based macOS infostealer that goes beyond typical credential theft. Delivered via a ClickFix-style fake... og:url: https://daily.dev/posts/amnesiastealer-macos-malware-that-hijacks-live-browser-sessions-not-just-passwords-ar2res3yc og:image: https://api.daily.dev/og/posts/AR2rEs3YC.png og:image:alt: AmnesiaStealer: macOS malware that hijacks live browser sessions, not just passwords og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AmnesiaStealer: macOS malware that hijacks live browser sessions, not just passwords **[Collections](https://daily.dev/sources/collections)** · 3 min read · 1 upvotes · 0 comments ## Summary Jamf Threat Labs has documented AmnesiaStealer, a Rust-based macOS infostealer that goes beyond typical credential theft. Delivered via a ClickFix-style fake GitHub page tricking victims into pasting a Terminal command, it harvests passwords, Keychain data, browser data, Apple Notes, Telegram sessions, local files, and crypto wallets. Its standout feature is a stream_module that clones the victim's Chromium browser profile, including session cookies, into a hidden headless browser, then opens a WebSocket connection via the Chrome DevTools Protocol for live, interactive remote control - mouse, keyboard, and a ~3fps screencast - letting attackers ride an authenticated session in real time across 16 Chromium-based browsers. On macOS 26, if it can't recover the Chrome Safe Storage key, it replaces it, permanently corrupting the victim's stored credentials while the attacker keeps decrypt access to already-stolen data. Jamf calls this the first documented pairing of cloned Chromium profiles with live CDP-based remote control of an authenticated session, and recommends blocking published indicators of compromise plus training users to distrust copy-paste Terminal instructions. ## Content Jamf Threat Labs has documented a new macOS infostealer called AmnesiaStealer, and it's a nastier piece of work than the usual credential-grabber. Rather than just scooping up passwords and moving on, it lets an attacker climb into your browser session and drive it around in real time. ## How it gets in The infection starts with a ClickFix-style trick: a fake GitHub download page, styled to look convincingly like the real thing, that walks victims through pasting a Terminal command. That command kicks off the install. It's a social engineering play more than a technical exploit, which is exactly why it works. Once running, the Rust-based malware behaves like a fairly standard stealer at first. It grabs the macOS login password, Keychain data, browser data, Apple Notes, Telegram sessions, and local files. It also targets cryptocurrency wallets. None of that is new territory for Mac malware. ## The part that's actually new What sets AmnesiaStealer apart is a third stage Jamf calls the stream_module. Instead of just exfiltrating cookies and calling it done, this module clones the victim's Chromium browser profile - session cookies and all - and loads it into a hidden, headless browser under the attacker's control. It works across 16 different Chromium-based browsers. From there, it opens a WebSocket connection using the Chrome DevTools Protocol, and the attacker gets live, interactive control: mouse movement, keyboard input, and a screencast of the session running at roughly 3 frames per second. It's slow, sure, but it's enough to click through a banking site or approve a transaction while impersonating an already-logged-in user. Cookies get exported in plaintext along the way. I keep coming back to how quiet this could be in practice. There's no obvious password reset trail, no new login alert from an unfamiliar device - the attacker is just riding along on a session you already opened. One more wrinkle: on macOS 26, if the malware fails to recover the Chrome Safe Storage key, it replaces it outright. That corrupts your stored credentials permanently on your end, while apparently still letting the attacker decrypt what they've already grabbed. A bit of scorched earth on the way out. Jamf is calling this the first documented case of macOS malware pairing cloned Chromium profiles with live CDP-based remote control of an authenticated session. Whether that holds up as more research comes in, it's a meaningful jump from "steal and leave" to "steal and stick around." ## What to do about it Jamf has published indicators of compromise and recommends blocking the associated infrastructure. Beyond the technical mitigations, the bigger fix is cultural: train people to be suspicious of any instructions that ask them to copy-paste a command into Terminal, no matter how official the source page looks. That single step is the entire attack chain's weak point. ## Questions this post answers ### What is AmnesiaStealer and how does it hijack a browser session on macOS? AmnesiaStealer is a Rust-based macOS infostealer documented by Jamf Threat Labs that clones a victim's Chromium browser profile, including session cookies, into a hidden headless browser under attacker control. It then opens a WebSocket connection using the Chrome DevTools Protocol, giving the attacker live mouse, keyboard, and screencast control of the authenticated session at roughly 3 frames per second across 16 Chromium-based browsers. _Security teams tracking emerging macOS threats like this can follow the details on daily.dev._ ### How does AmnesiaStealer initially get installed on a Mac? It spreads through a ClickFix-style social engineering trick: a fake GitHub download page styled to look legitimate walks victims through pasting a Terminal command that triggers the install. No technical exploit is needed since the victim manually executes the malicious command themselves, making user awareness the main defense. _Anyone training teams against social-engineering attacks can keep tabs on tactics like this via daily.dev._ ### What happens on macOS 26 if AmnesiaStealer can't recover the Chrome Safe Storage key? On macOS 26, if AmnesiaStealer fails to recover the Chrome Safe Storage key, it replaces the key outright, which permanently corrupts the victim's stored credentials on their end while the attacker still retains the ability to decrypt data already stolen before the replacement occurred. _Developers securing macOS 26 environments can track threat research like this through daily.dev._ ## Similar posts on daily.dev - [New CrashStealer malware poses as Apple crash reporting tool](https://daily.dev/posts/new-crashstealer-malware-poses-as-apple-crash-reporting-tool-olhhkemin) · BleepingComputer · 0 upvotes · 0 comments - [Newly discovered PamStealer isn’t your typical macOS malware](https://daily.dev/posts/newly-discovered-pamstealer-isn-t-your-typical-macos-malware-yqlsfpqg3) · Ars Technica · 1 upvotes · 0 comments - [New macOS ClickFix attack silently mounts DMGs to push infostealer](https://daily.dev/posts/new-macos-clickfix-attack-silently-mounts-dmgs-to-push-infostealer-tp3l5rbe7) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#malware](https://daily.dev/tags/malware), [#mac](https://daily.dev/tags/mac) [View this post on daily.dev](https://daily.dev/posts/amnesiastealer-macos-malware-that-hijacks-live-browser-sessions-not-just-passwords-ar2res3yc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"AmnesiaStealer: macOS malware that hijacks live browser sessions, not just passwords","url":"https://daily.dev/posts/amnesiastealer-macos-malware-that-hijacks-live-browser-sessions-not-just-passwords-ar2res3yc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/amnesiastealer-macos-malware-that-hijacks-live-browser-sessions-not-just-passwords-ar2res3yc"},"datePublished":"2026-08-17T12:17:51.926Z","dateModified":"2026-09-13T19:26:09.909Z","description":"Jamf Threat Labs has documented AmnesiaStealer, a Rust-based macOS infostealer that goes beyond typical credential theft. Delivered via a ClickFix-style fake...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/60d9e5f909c3c33db32ff3a9170012ec?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/60d9e5f909c3c33db32ff3a9170012ec?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/amnesiastealer-macos-malware-that-hijacks-live-browser-sessions-not-just-passwords-ar2res3yc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,malware,mac","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"AmnesiaStealer: macOS malware that hijacks live browser sessions, not just passwords"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/amnesiastealer-macos-malware-that-hijacks-live-browser-sessions-not-just-passwords-ar2res3yc#faq","mainEntity":[{"@type":"Question","name":"What is AmnesiaStealer and how does it hijack a browser session on macOS?","acceptedAnswer":{"@type":"Answer","text":"AmnesiaStealer is a Rust-based macOS infostealer documented by Jamf Threat Labs that clones a victim's Chromium browser profile, including session cookies, into a hidden headless browser under attacker control. It then opens a WebSocket connection using the Chrome DevTools Protocol, giving the attacker live mouse, keyboard, and screencast control of the authenticated session at roughly 3 frames per second across 16 Chromium-based browsers. Security teams tracking emerging macOS threats like this can follow the details on daily.dev."}},{"@type":"Question","name":"How does AmnesiaStealer initially get installed on a Mac?","acceptedAnswer":{"@type":"Answer","text":"It spreads through a ClickFix-style social engineering trick: a fake GitHub download page styled to look legitimate walks victims through pasting a Terminal command that triggers the install. No technical exploit is needed since the victim manually executes the malicious command themselves, making user awareness the main defense. Anyone training teams against social-engineering attacks can keep tabs on tactics like this via daily.dev."}},{"@type":"Question","name":"What happens on macOS 26 if AmnesiaStealer can't recover the Chrome Safe Storage key?","acceptedAnswer":{"@type":"Answer","text":"On macOS 26, if AmnesiaStealer fails to recover the Chrome Safe Storage key, it replaces the key outright, which permanently corrupts the victim's stored credentials on their end while the attacker still retains the ability to decrypt data already stolen before the replacement occurred. Developers securing macOS 26 environments can track threat research like this through daily.dev."}}]} ```