A new macOS information stealer called AmnesiaStealer, spread via ClickFix campaigns using fake GitHub download pages, can clone a victim's Chromium browser profile including authenticated sessions and load it into a hidden headless browser. Researchers at Jamf found the malware's stream_module gives attackers live, interactive remote control over the victim's authenticated sessions via the Chrome DevTools Protocol, including mouse/keyboard input and a live screencast at roughly 3fps. It targets 16 Chromium-based browsers, harvests keychain data, Apple Notes, documents, Telegram sessions, and cryptocurrency wallets, and on macOS 26 replaces the Chrome Safe Storage key when it cannot recover it, permanently corrupting stored credentials while letting the attacker decrypt data later. It is described as the first documented macOS malware combining cloned Chromium profiles with live CDP-based remote control of authenticated sessions.
Table of contents
Related Articles:Questions this post answers
What is AmnesiaStealer and how does it hijack browser sessions on macOS?
AmnesiaStealer is a macOS information-stealing malware distributed through ClickFix campaigns using fake GitHub download pages with password-protected ZIP archives. Its stream_module clones a victim's Chromium browser profile, including authentication cookies, into a hidden headless browser instance, then uses the Chrome DevTools Protocol to let an attacker remotely navigate, click, and view a live screencast of the victim's authenticated sessions at about 3fps. Security teams tracking new macOS malware techniques can follow infostealer research on daily.dev.
Which browsers can AmnesiaStealer's remote control module target?
AmnesiaStealer's stream_module can duplicate profiles from seven Chromium-based browsers: Google Chrome, Microsoft Edge, Vivaldi, Arc, Opera, Brave, and Chromium itself, since they share the same DevTools Protocol, launch flags, and cookie encryption. The broader malware can exfiltrate data such as cookies, passwords, and browsing history from 16 Chromium-based browsers overall. Anyone evaluating browser session security risks can track this kind of malware analysis on daily.dev.
How does AmnesiaStealer affect Chrome Safe Storage keys on macOS 26?
When AmnesiaStealer runs on macOS 26 and cannot recover the existing Chrome Safe Storage key, it replaces it with an attacker-supplied value instead. This permanently makes previously stored cookies and passwords unreadable to the victim while still allowing the attacker to decrypt that data later using their own key. Developers securing macOS deployments can keep up with emerging credential-theft techniques on daily.dev.