A new macOS threat called AmnesiaStealer malware gives attackers an unusual way to abuse stolen browser sessions. Instead of simply stealing cookies and passwords, it can copy a victim’s Chromium browser profile and remotely operate it in a hidden browser instance.
The malware spreads through ClickFix attacks that use fake GitHub download pages. Victims receive instructions to run a command in Terminal, which launches a script that downloads a password-protected ZIP archive containing the malicious payload.
Security researchers at Jamf found that the campaign uses a delivery template previously linked to Atomic and MacSync infostealers.
Malware targets browser data and macOS secrets
AmnesiaStealer malware targets 16 Chromium-based browsers. It steals browser profiles, saved logins, cookies, history, bookmarks, extensions and other local browser data.
It also searches for cryptocurrency wallet information, Apple Notes, documents, Telegram sessions and system details. The malware can prompt victims for their macOS password, then use it to collect Keychain data and other sensitive information.
The campaign appears especially dangerous because browser sessions often remain authenticated. Attackers may gain access to online accounts without needing to enter a password or pass a separate login challenge.
Hidden browser copies authenticated sessions
The malware includes a component named stream_module. Attackers retrieve it with a remote_stream command and use it to control a victim’s browser sessions remotely.
This component can duplicate profiles from seven Chromium-based browsers, including Chrome, Edge, Vivaldi, Arc, Opera, Brave and Chromium. These browsers share the Chrome DevTools Protocol, similar launch flags and cookie encryption methods.
AmnesiaStealer then launches the legitimate browser executable in headless mode. It creates a cloned profile and opens it without displaying a browser window to the victim.
The malware connects to an attacker-controlled relay through a WebSocket channel. Operators can then navigate websites, click buttons, type text, manage tabs and scroll through pages. They also receive browser status data and live screencast frames from the hidden session.
Chrome DevTools Protocol enables live control
A second connection links the malware to the local headless browser through its Chrome DevTools Protocol interface. This gives attackers access to browser automation features normally used by developers.
With this access, operators can export or import cookies and use websites through the victim’s existing authenticated session. The attacker effectively receives a live browser environment that still carries the victim’s browser, device and network identifiers.
Jamf said the remote control feature delivers a more serious capability than ordinary file theft. It allows criminals to interact with online portals directly instead of relying only on stolen data.
macOS 26 fallback can damage stored data
The researchers also found a fallback feature for macOS 26. If the malware cannot recover Chrome’s existing Safe Storage key, it replaces the key with one supplied by the attacker.
That move makes the victim’s previously stored cookies and passwords permanently unreadable. However, it may still allow the attacker to decrypt the stolen data later.
How to stay protected
Users should never run Terminal commands copied from websites, pop-ups or unfamiliar download pages. ClickFix attacks rely on social engineering, so attackers often convince victims to perform the harmful action themselves.
Download software only from trusted sources and keep macOS, browsers and security tools up to date. Anyone who suspects an infection should change passwords from a clean device, revoke active sessions and review their browser extensions and cryptocurrency wallets.
Conclusion
AmnesiaStealer malware shows how macOS infostealers are moving beyond simple password and cookie theft. By cloning Chromium profiles and remotely controlling hidden browser sessions, attackers can use a victim’s authenticated accounts in real time.
0 responses to “AmnesiaStealer malware hijacks macOS browser sessions through remote control”