--- title: New AmnesiaStealer macOS malware hijacks browser... description: A new macOS information stealer called AmnesiaStealer, spread via ClickFix campaigns using fake GitHub download pages, can clone a victim's Chromium browser... canonical: https://daily.dev/posts/new-amnesiastealer-macos-malware-hijacks-browser-sessions-via-remote-control-nptpus9uc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: New AmnesiaStealer macOS malware hijacks browser sessions via remote control | daily.dev og:description: A new macOS information stealer called AmnesiaStealer, spread via ClickFix campaigns using fake GitHub download pages, can clone a victim's Chromium browser... og:url: https://daily.dev/posts/new-amnesiastealer-macos-malware-hijacks-browser-sessions-via-remote-control-nptpus9uc og:image: https://api.daily.dev/og/posts/nPTpus9uC.png og:image:alt: New AmnesiaStealer macOS malware hijacks browser sessions via remote control og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # New AmnesiaStealer macOS malware hijacks browser sessions via remote control **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 4 min read · 0 upvotes · 0 comments ## Summary A new macOS information stealer called AmnesiaStealer, spread via ClickFix campaigns using fake GitHub download pages, can clone a victim's Chromium browser profile including authenticated sessions and load it into a hidden headless browser. Researchers at Jamf found the malware's stream_module gives attackers live, interactive remote control over the victim's authenticated sessions via the Chrome DevTools Protocol, including mouse/keyboard input and a live screencast at roughly 3fps. It targets 16 Chromium-based browsers, harvests keychain data, Apple Notes, documents, Telegram sessions, and cryptocurrency wallets, and on macOS 26 replaces the Chrome Safe Storage key when it cannot recover it, permanently corrupting stored credentials while letting the attacker decrypt data later. It is described as the first documented macOS malware combining cloned Chromium profiles with live CDP-based remote control of authenticated sessions. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is AmnesiaStealer and how does it hijack browser sessions on macOS? AmnesiaStealer is a macOS information-stealing malware distributed through ClickFix campaigns using fake GitHub download pages with password-protected ZIP archives. Its stream_module clones a victim's Chromium browser profile, including authentication cookies, into a hidden headless browser instance, then uses the Chrome DevTools Protocol to let an attacker remotely navigate, click, and view a live screencast of the victim's authenticated sessions at about 3fps. _Security teams tracking new macOS malware techniques can follow infostealer research on daily.dev._ ### Which browsers can AmnesiaStealer's remote control module target? AmnesiaStealer's stream_module can duplicate profiles from seven Chromium-based browsers: Google Chrome, Microsoft Edge, Vivaldi, Arc, Opera, Brave, and Chromium itself, since they share the same DevTools Protocol, launch flags, and cookie encryption. The broader malware can exfiltrate data such as cookies, passwords, and browsing history from 16 Chromium-based browsers overall. _Anyone evaluating browser session security risks can track this kind of malware analysis on daily.dev._ ### How does AmnesiaStealer affect Chrome Safe Storage keys on macOS 26? When AmnesiaStealer runs on macOS 26 and cannot recover the existing Chrome Safe Storage key, it replaces it with an attacker-supplied value instead. This permanently makes previously stored cookies and passwords unreadable to the victim while still allowing the attacker to decrypt that data later using their own key. _Developers securing macOS deployments can keep up with emerging credential-theft techniques on daily.dev._ ## Similar posts on daily.dev - [New macOS ClickFix attack silently mounts DMGs to push infostealer](https://daily.dev/posts/new-macos-clickfix-attack-silently-mounts-dmgs-to-push-infostealer-tp3l5rbe7) · BleepingComputer · 0 upvotes · 0 comments - [New macOS stealer campaign uses Script Editor in ClickFix attack](https://daily.dev/posts/new-macos-stealer-campaign-uses-script-editor-in-clickfix-attack-khhsvonhe) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#malware](https://daily.dev/tags/malware), [#mac](https://daily.dev/tags/mac) [View this post on daily.dev](https://daily.dev/posts/new-amnesiastealer-macos-malware-hijacks-browser-sessions-via-remote-control-nptpus9uc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"New AmnesiaStealer macOS malware hijacks browser sessions via remote control","url":"https://daily.dev/posts/new-amnesiastealer-macos-malware-hijacks-browser-sessions-via-remote-control-nptpus9uc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/new-amnesiastealer-macos-malware-hijacks-browser-sessions-via-remote-control-nptpus9uc"},"datePublished":"2026-08-16T15:11:23.130Z","dateModified":"2026-08-17T12:18:23.877Z","description":"A new macOS information stealer called AmnesiaStealer, spread via ClickFix campaigns using fake GitHub download pages, can clone a victim's Chromium browser...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d52a3f1bbff5533ca9689e984e961786?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d52a3f1bbff5533ca9689e984e961786?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/new-amnesiastealer-macos-malware-hijacks-browser-sessions-via-remote-control-nptpus9uc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,malware,mac","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"New AmnesiaStealer macOS malware hijacks browser sessions via remote control"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/new-amnesiastealer-macos-malware-hijacks-browser-sessions-via-remote-control-nptpus9uc#faq","mainEntity":[{"@type":"Question","name":"What is AmnesiaStealer and how does it hijack browser sessions on macOS?","acceptedAnswer":{"@type":"Answer","text":"AmnesiaStealer is a macOS information-stealing malware distributed through ClickFix campaigns using fake GitHub download pages with password-protected ZIP archives. Its stream_module clones a victim's Chromium browser profile, including authentication cookies, into a hidden headless browser instance, then uses the Chrome DevTools Protocol to let an attacker remotely navigate, click, and view a live screencast of the victim's authenticated sessions at about 3fps. Security teams tracking new macOS malware techniques can follow infostealer research on daily.dev."}},{"@type":"Question","name":"Which browsers can AmnesiaStealer's remote control module target?","acceptedAnswer":{"@type":"Answer","text":"AmnesiaStealer's stream_module can duplicate profiles from seven Chromium-based browsers: Google Chrome, Microsoft Edge, Vivaldi, Arc, Opera, Brave, and Chromium itself, since they share the same DevTools Protocol, launch flags, and cookie encryption. The broader malware can exfiltrate data such as cookies, passwords, and browsing history from 16 Chromium-based browsers overall. Anyone evaluating browser session security risks can track this kind of malware analysis on daily.dev."}},{"@type":"Question","name":"How does AmnesiaStealer affect Chrome Safe Storage keys on macOS 26?","acceptedAnswer":{"@type":"Answer","text":"When AmnesiaStealer runs on macOS 26 and cannot recover the existing Chrome Safe Storage key, it replaces it with an attacker-supplied value instead. This permanently makes previously stored cookies and passwords unreadable to the victim while still allowing the attacker to decrypt that data later using their own key. Developers securing macOS deployments can keep up with emerging credential-theft techniques on daily.dev."}}]} ```