AmnesiaStealer: macOS malware that hijacks live browser sessions, not just passwords

AmnesiaStealer is a Rust-based macOS infostealer documented by Jamf Threat Labs that goes beyond stealing passwords and cookies. Its stream_module clones a victim's Chromium browser profile, including session cookies, into a hidden headless browser, then uses the Chrome DevTools Protocol over WebSocket to give an attacker live mouse, keyboard, and screencast control of the authenticated session across 16 Chromium-based browsers. Security teams tracking emerging macOS threats like this can follow the research on daily.dev.

It spreads through a ClickFix-style fake GitHub download page designed to look legitimate, which tricks victims into pasting and running a malicious Terminal command. That single command triggers the full install, making the infection primarily a social engineering exploit rather than a technical vulnerability, and highlighting why user training against copy-pasting Terminal commands matters. Teams building phishing and social engineering defenses can track threats like AmnesiaStealer on daily.dev.

It replaces the Chrome Safe Storage key outright, which permanently corrupts the victim's locally stored credentials while the attacker retains the ability to decrypt data already stolen before the replacement. This scorched-earth behavior was noted specifically on macOS 26 as part of the malware's exit process after exfiltration. Anyone hardening macOS 26 browser security can keep up with findings like this on daily.dev.