A new Mac attack chain ends with criminals holding live control of the victim’s browser, after quietly draining passwords, notes, and chat history along the way.
The malware, tracked as AmnesiaStealer by Jamf Threat Labs, was detailed on August 13 via The Hacker News. Researcher Thijs Xhaflaire described a three-stage infection that starts at a counterfeit GitHub page labeled “Download for macOS.”
The page poses as a verified publisher and leans on a ClickFix-style trick: visitors copy a Base64-encoded command into Terminal. That command pulls a password-protected ZIP archive, unpacks a first-stage Mach-O binary, and deletes itself from the host.
Stage two is a Rust infostealer that harvests the Keychain, browser data, Apple Notes, and Telegram. Its encrypted configuration carries command-and-control endpoints such as debug.allllowef[.]space, plus a switchable clipboard hijacker aimed at a dozen cryptocurrencies from Bitcoin to Monero.
Stage three, a stream module fetched on demand, hands the operator hidden, interactive control of the victim’s browser. The payload also profiles the host and its location, then shows a native prompt that requests the system password under the guise of an installer, validating it against the local directory service and looping the dialog until it gets the right one.
Jamf advises Mac users to install software only from official developer sites and to treat copy-paste Terminal instructions from web pages as a red flag. AmnesiaStealer is the latest in a wave of Rust-based macOS stealers, but its live browser takeover puts it in a class of its own.
