A newly identified macOS infostealer, dubbed AmnesiaStealer, is using a polished ClickFix campaign to trick users into installing malware that steals credentials and silently commandeers active Chromium browser sessions.
Jamf Threat Labs uncovered the operation after investigating a counterfeit GitHub download portal hosted at github.aoitour[.]com. The site closely imitates GitHub’s dark interface, Octocat branding, and “Verified Publisher” badge, giving visitors a convincing impression of legitimacy.
Rather than providing a normal application download, the fake page presents a “Terminal installation” section with a one-click copy button. It instructs victims to open Terminal, paste a supplied command, press Return, and enter their macOS password.
AmnesiaStealer macOS Malware Uses ClickFix
This technique, known as ClickFix, shifts the final execution step to the user, bypassing many conventional warnings because the victim manually launches the malicious command.
ClickFix has become increasingly common in macOS-focused social-engineering campaigns. Threat actors have previously used similar lures to distribute malware families, including Atomic Stealer (also known as AMOS) and MacSync.
AmnesiaStealer demonstrates how attackers can reuse a familiar phishing template while replacing the backend infrastructure, malware payloads, and post-compromise objectives.
After execution, the command launches a concealed shell script that downloads a password-protected ZIP archive. The script extracts a disguised binary into the /tmp directory, removes Apple’s quarantine attribute, executes the payload, and deletes artifacts intended to hide the initial infection chain.
The use of a password-protected archive can also reduce visibility for security tools that inspect downloaded files before extraction.
The primary payload is a Rust-based infostealer designed to profile the infected Mac and gather sensitive information. It displays a spoofed native-looking “Installer” password prompt to capture the user’s login credential.
The malware then attempts to use that password to access the macOS keychain, Apple Notes, Telegram session data, browser profiles, and locally stored documents.
Thijs Xhaflaire named the malware AmnesiaStealer because it communicates with an attacker-controlled backend called the “Amnesia Panel.” Its embedded configuration is decrypted using the key 4mn3s1a_2o26!xK, revealing further operational behavior.
This backend-driven architecture allows operators to decide which additional capabilities to deploy after assessing a compromised device. The campaign’s most concerning feature is a third-stage component called stream_module.
Delivered only when requested by the attacker’s panel, this module clones the victim’s browser profile, launches the clone in headless mode, and connects to it through the Chrome DevTools Protocol. It can provide attackers with a live screencast while enabling control of the mouse, keyboard, and navigation.
That capability poses a serious browser session hijacking risk. Instead of merely stealing cookies or saved passwords, attackers may operate the victim’s already authenticated sessions for email, banking, cloud platforms, and social media.
Because the cloned browser runs headlessly, the victim may not see the malicious activity occurring in their account sessions.
Some of AmnesiaStealer’s privacy-bypass attempts rely on older techniques, including an APFS snapshot bypass patched by Apple years ago. These actions largely fail on modern macOS versions, and the malware’s own debug logs reportedly document those failures.
Jamf Threat Labs stated that its credential theft and browser session capabilities remain effective enough to pose a substantial threat.
The strongest defense is to never paste unverified commands into Terminal, particularly from download pages, ads, pop-ups, or unsolicited instructions.
Organizations should keep macOS updated, deploy endpoint protection, monitor suspicious browser automation activity, and train users to treat unexpected installer password prompts as potential credential-phishing attempts.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
