AmnesiaStealer Grants Live Control of macOS Browsers to Attackers
A new macOS malware allows remote, interactive control of victims' browsers.
1AmnesiaStealer's Target and Distribution Method
AmnesiaStealer targets macOS users through fake GitHub pages. Users are tricked by a realistic GitHub theme and a 'Verified Publisher' badge. Instead of a download button, they are asked to paste a Terminal command. This method was also used in Atomic Stealer and MacSync campaigns, indicating shared infrastructure among multiple malware families.
2Multi-Stage Attack Chain
AmnesiaStealer operates in three stages: First, a shell script downloads and executes the payload. Second, a Rust-based info-stealer collects keychain, browsers, Apple Notes, and Telegram data. The third stage involves a module that grants attackers hidden, interactive control of the victim's browser. This feature sets AmnesiaStealer apart from other malware.
3Live Browser Control
The stream_module clones the victim's browser profile and runs it in headless mode. Attackers can remotely control the browser in real-time via keyboard commands. While the victim's browser window appears normal, a hidden session is manipulated in the background. This method offers interactive control beyond traditional data theft.
4Password Phishing and Keychain Access
The malware tricks victims with a fake macOS Installer password prompt. The entered password is validated against the local directory service and retried until correct. The captured password is reused throughout the attack chain, unlocking the keychain and being stored in plaintext on disk for sudo commands.
5Data Collection and Encryption Bypass
AmnesiaStealer collects cookies, credentials, history, and extension data from 16 Chromium-based browsers. If it cannot access Chrome's Safe Storage key normally, it deletes and replaces it with a known key. This allows decryption of newly stolen data while potentially locking out previously stored information.
6Stealth Session and Fingerprint Evasion
The stream module steals cookies via Chrome DevTools Protocol, retrieving plaintext values already decrypted in memory. It also injects a stealth script to modify browser fingerprinting APIs, preventing detection of the headless session as automation. This ensures the hidden session remains undetected.
7Persistence and C2 Infrastructure
The malware achieves persistence by impersonating Apple's crash reporting service with a root LaunchDaemon. It survives reboots under the console user's account. The C2 backend, named 'Amnesia Panel,' resides at the root of the delivery domain and returns Russian error messages. Identical URL patterns suggest a shared builder infrastructure.
8Threat Significance and Detection Clues
AmnesiaStealer poses a serious threat to macOS users. Live browser control is more dangerous than traditional data theft. Abnormal behaviors like Safe Storage key deletion can serve as detection signals. Shared infrastructure and Russian messages indicate an organized operation rather than a one-off experiment.