AmnesiaStealer Targets macOS Users with Fake GitHub Lure and Browser Session Hijacking

A sophisticated new macOS infostealer, dubbed AmnesiaStealer, has been identified by researchers at Jamf Threat Labs, employing a deceptive social engineering tactic to compromise user systems. The malware campaign utilizes a counterfeit website, github.aoitour[.]com, which meticulously mimics the legitimate GitHub platform's appearance, including its dark theme, Octocat logo, and "Verified Publisher" badge. This carefully crafted facade aims to lure unsuspecting users into downloading what they believe to be legitimate software.

The primary infection vector relies on a technique known as "ClickFix." Instead of offering a direct download, the fake GitHub page presents users with a "Terminal installation" box. It provides step-by-step instructions and a one-click copy button for a malicious Terminal command. Users are prompted to open their Terminal application, paste the command, press Enter, and then provide their device password. This method has been previously observed in other Mac malware campaigns, indicating a reuse of effective deceptive strategies by threat actors.

Upon execution of the malicious command, a hidden shell script silently downloads a password-protected ZIP archive. This archive contains a disguised binary that is extracted into the system's temporary folder (/tmp). The script then removes Apple's quarantine flag, effectively bypassing security checks, and launches the malware payload before erasing its own tracks to maintain stealth. This initial stage is designed to be as inconspicuous as possible.

Following the execution of the primary payload, a Rust-based infostealer component is activated. This module begins by profiling the victim's machine and then displays a fake native "Installer" password prompt. This prompt is designed to trick users into entering their login credentials, which the malware then uses to unlock the system's keychain, access Apple Notes, hijack Telegram sessions, steal browser data, and exfiltrate sensitive documents. The malware communicates with its command-and-control infrastructure via the "Amnesia Panel," with its configuration unlocked by the key 4mn3s1a_2o26!xK.

The most alarming capability of AmnesiaStealer lies in its stream_module, a component fetched remotely from the attacker's panel. This module is capable of cloning the victim's browser profile and launching it in a headless mode. Crucially, it then connects to the Chrome DevTools Protocol. This connection grants attackers a live screencast of the victim's browser session and provides them with full mouse, keyboard, and navigation control. Effectively, this allows threat actors to operate the user's logged-in browser sessions, including banking and social media accounts, without the victim's awareness.

Jamf Threat Labs noted that some of AmnesiaStealer's attempts to bypass Apple's security protections utilize outdated techniques that were patched in previous macOS versions, such as a 2020 APFS snapshot bypass. On modern macOS versions, these specific bypasses often fail, as indicated by the malware's own debug logs. However, the core functionalities of credential theft and browser session hijacking remain highly effective, particularly against users who may have already granted broader system permissions.

AmnesiaStealer exemplifies a growing trend in malware distribution, combining convincing phishing pages with staged, remotely controlled payloads rather than relying on a single, static malware file. Given that the initial infection hinges entirely on tricking a user into executing a Terminal command, the most effective defense remains user education: never paste unknown commands into the Terminal, especially those originating from unsolicited download prompts. Maintaining up-to-date macOS, enabling robust browser and endpoint threat protection, and treating any password prompt associated with "software installers" with extreme suspicion are vital precautions against this evolving threat.