# AmnesiaStealer Grants Live Control of macOS Browsers to Attackers A new macOS malware allows remote, interactive control of victims' browsers. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-08-14 - **Original article:** - **On Brifing:** https://brifing.si/s/525bcee6-4bd7-4aec-8c1e-d99de0d50e3d ## AmnesiaStealer's Target and Distribution Method AmnesiaStealer targets macOS users through fake GitHub pages. Users are tricked by a realistic GitHub theme and a 'Verified Publisher' badge. Instead of a download button, they are asked to paste a Terminal command. This method was also used in Atomic Stealer and MacSync campaigns, indicating shared infrastructure among multiple malware families. ## Multi-Stage Attack Chain AmnesiaStealer operates in three stages: First, a shell script downloads and executes the payload. Second, a Rust-based info-stealer collects keychain, browsers, Apple Notes, and Telegram data. The third stage involves a module that grants attackers hidden, interactive control of the victim's browser. This feature sets AmnesiaStealer apart from other malware. ## Live Browser Control The stream_module clones the victim's browser profile and runs it in headless mode. Attackers can remotely control the browser in real-time via keyboard commands. While the victim's browser window appears normal, a hidden session is manipulated in the background. This method offers interactive control beyond traditional data theft. ## Password Phishing and Keychain Access The malware tricks victims with a fake macOS Installer password prompt. The entered password is validated against the local directory service and retried until correct. The captured password is reused throughout the attack chain, unlocking the keychain and being stored in plaintext on disk for sudo commands. ## Data Collection and Encryption Bypass AmnesiaStealer collects cookies, credentials, history, and extension data from 16 Chromium-based browsers. If it cannot access Chrome's Safe Storage key normally, it deletes and replaces it with a known key. This allows decryption of newly stolen data while potentially locking out previously stored information. ## Stealth Session and Fingerprint Evasion The stream module steals cookies via Chrome DevTools Protocol, retrieving plaintext values already decrypted in memory. It also injects a stealth script to modify browser fingerprinting APIs, preventing detection of the headless session as automation. This ensures the hidden session remains undetected. ## Persistence and C2 Infrastructure The malware achieves persistence by impersonating Apple's crash reporting service with a root LaunchDaemon. It survives reboots under the console user's account. The C2 backend, named 'Amnesia Panel,' resides at the root of the delivery domain and returns Russian error messages. Identical URL patterns suggest a shared builder infrastructure. ## Threat Significance and Detection Clues AmnesiaStealer poses a serious threat to macOS users. Live browser control is more dangerous than traditional data theft. Abnormal behaviors like Safe Storage key deletion can serve as detection signals. Shared infrastructure and Russian messages indicate an organized operation rather than a one-off experiment. ## Sources covering this story - https://securityaffairs.com/197190/malware/amnesiastealer-gives-attackers-live-control-of-victims-macos-browsers.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._