{"id":2412,"date":"2026-08-18T11:16:55","date_gmt":"2026-08-18T11:16:55","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2412"},"modified":"2026-08-18T11:16:55","modified_gmt":"2026-08-18T11:16:55","slug":"amnesiastealer-hijacks-chromium-sessions-to-give-attackers-live-browser-control-on-macos","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2412","title":{"rendered":"AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS"},"content":{"rendered":"<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjKseTvCwFqcMpefo-t9iVJcgB3VNAmPh_RHG1CadNUW-VA2Dn2NRE2HJQwnnwY9JqGD4AEElHZHGX9IlrT2Ts9ayfnIqk_sEJz4uSNzDi8wZhneDyiEovqm8LvP_8QTN5XoF92mQcWDeQFiS_1cJeOeWSC7J11alfbow-dRhIAOVL5y_ggDVEmsbDQSGpo\/s1700-e365\/chrome-remote.jpg\" style=\"clear: left; display: block; float: left;  text-align: center;\"><\/a><\/div>\n<p>Cybersecurity researchers have disclosed details of a new macOS-oriented, Rust-based information stealer called <strong>AmnesiaStealer<\/strong> that&#8217;s capable of hijacking Chromium web browsers to steal session data.<\/p>\n<p>The multi-stage stealer is spread via a counterfeit GitHub download page titled \u00abDownload for macOS\u00bb and claims to be from a verified publisher. The page employs a ClickFix-style lure that instructs users to copy and paste a Base64-encoded command into the macOS Terminal app.<\/p>\n<p>The attack chain ultimately leads to the deployment of AmnesiaStealer via a dropper script hosted on a remote server, which, according to <a href=\"https:\/\/www.jamf.com\/blog\/amnesia-stealer-macos-infostealer-clickfix\/\" rel=\"nofollow\" target=\"_blank\">Jamf Threat Labs<\/a>, runs in three distinct stages.<\/p>\n<p>\u00abThe first is a shell script that downloads and launches the payload,\u00bb security researcher Thijs Xhaflaire said in a report shared with The Hacker News. \u00abThe second is a Rust infostealer that harvests the Keychain, browsers, Apple Notes, and Telegram. The third is a stream_module, fetched on command, that gives the operator hidden, interactive control of the victim&#8217;s browser.\u00bb<\/p>\n<p>The script is designed to retrieve a password-protected ZIP archive and delete itself from the host. Extracted from the archive is the first-stage Mach-O binary, a Rust stealer that includes an embedded encrypted configuration that can be modified at the build level through the configuration without making any code changes. It includes the following details &#8211;<\/p>\n<ul>\n<li>Command-and-control (C2) endpoints (i.e., \u00abdebug.allllowef[.]space\/send\/\u00bb)<\/li>\n<li>Enable or disable a clipboard-hijacking (aka clipper) module (\u00abCLIPPER_ENABLED\u00bb) capable of targeting cryptocurrencies like Bitcoin, Bitcoin Cash, Ethereum, TRON, Litecoin, Monero, Solana, Ripple, and Cosmos (ATOM).<\/li>\n<\/ul>\n<p>The Rust payload also performs host reconnaissance and geolocation profiling, and displays a native prompt to capture the system password under the guise of an installer. The entered password is validated against the local directory service via dscl to ensure that only the correct password is exfiltrated.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/zero-trust-claude-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEj8iAp2j8rqTq6aptj6yiYHC-B73UxnWI2NQMt0azp6OVLq9JkO8cpYokLWa8t_IKqrHKPsaM5D_lQ9Ip7kZTi3at4oYfzN1m1b_T4b6MuzBWtmlhdLcQ0nZHicD94rliREFDRewsKBQCTYrAAVNzYKj84_0EZskDUxvkc972s9fYAqcQGEQjVZTc0cr7TB\/s728-e100\/ThreatLocker-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>If the check fails, it triggers a dialog loop with the message \u00abIncorrect password. Please try again.\u00bb until the correct password is entered. \u00abA fallback path writes \/tmp\/tempAppleScript.scpt and invokes osascript if the native alert fails, though on our host the native path succeeded and no osascript prompt was raised,\u00bb Jamf said.<\/p>\n<p><a name=\"more\"\/><\/p>\n<p>\u00abThe captured password is then reused throughout the chain. It is piped into sudo -S for privileged reads, passed to security unlock-keychain -p , and written to disk in cleartext, both in the staging directory as pwd and in the user&#8217;s home directory as ~\/.pwd.\u00bb<\/p>\n<p>It&#8217;s worth noting that this behavior has also been observed in another macOS stealer family called <a href=\"https:\/\/www.group-ib.com\/blog\/clicklock-stealer-macos-malware\/\" target=\"_blank\">ClickLock Stealer<\/a> that has targeted users located in Europe, North America, the Middle East, and Africa via phishing pages employing the ClickFix technique.<\/p>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEg37Va5NLBS2s0VpyQ5nx54PpQ2HAJvchiSLoim8lOeJn9zbRCBWTisbzgJq0AMocrAQfpJJwytFWv3MRDDROGZrwT5SoGIFzTNv9HfKFqtjNpNCWe7toA43Gd8k_-ef0vQXwxUFW6FqzmQMEz4tb7pvo0kaz7UYnnM93VBgva3ncIa4_6H1BSm1N2HGyyN\/s1700-e365\/jamf.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEg37Va5NLBS2s0VpyQ5nx54PpQ2HAJvchiSLoim8lOeJn9zbRCBWTisbzgJq0AMocrAQfpJJwytFWv3MRDDROGZrwT5SoGIFzTNv9HfKFqtjNpNCWe7toA43Gd8k_-ef0vQXwxUFW6FqzmQMEz4tb7pvo0kaz7UYnnM93VBgva3ncIa4_6H1BSm1N2HGyyN\/s1700-e365\/jamf.jpg\" alt=\"\" border=\"0\" data-original-height=\"838\" data-original-width=\"1280\"\/><\/a><\/div>\n<p>Also present is an AppleScript file that mutes the system sound and then proceeds to harvest data from Apple Notes, Telegram sessions, Safari, files matching certain extensions (.txt, .pdf, .rtf, .doc, .wallet, .key, .jpg, .png, and .csv) across ~\/Desktop, ~\/Documents, and ~\/Download folders, and iCloud Keychain using the captured system password.<\/p>\n<p>Some of the other actions performed by the stealer are as follows-<\/p>\n<ul>\n<li>Target 16 Chromium-family browsers, including Google Chrome, Brave, Arc, and Microsoft Edge, to gather Cookies, Login Data,<\/li>\n<li>Login Data for Account, Web Data, History, Bookmarks, Local State, Preferences, and the Extensions directory.<\/li>\n<li>Read Chrome Safe Storage password from the Keychain and use it to recover master keys that are used to secure data stored in a user&#8217;s Chrome profile folder.<\/li>\n<li>Steal cookies from Safari based on the macOS version, using a TCC bypass flaw (<a href=\"https:\/\/theevilbit.github.io\/posts\/cve_2020_9771\/\" target=\"_blank\">CVE-2020-9771<\/a>) to target macOS machines running Catalina. The technique also works on macOS 26 but only when the malware possesses Full Disk Access (which it does not).<\/li>\n<li>Establish persistence by means of a root LaunchDaemon that impersonates Apple&#8217;s crash reporting service.<\/li>\n<li>Stage collected data in a directory named with 25 random alphanumeric characters under \u00ab\/tmp\u00bb and then archive and exfiltrate it.<\/li>\n<\/ul>\n<p>Furthermore, the \u00abremote_stream\u00bb command issued by the C2 server becomes a trigger for the first stage payload to fetch and execute a second Rust binary from the same infrastructure that enables interactive remote control over the <a href=\"https:\/\/chromedevtools.github.io\/devtools-protocol\/\" target=\"_blank\">Chrome DevTools<\/a> Protocol (<a href=\"https:\/\/chromedevtools.github.io\/devtools-protocol\/\" target=\"_blank\">CDP<\/a>).<\/p>\n<p>The module supports seven Chromium-family browsers, namely Chrome, Brave, Microsoft Edge, Arc, Opera, Vivaldi, and Chromium, and launches the browser executable in headless mode to steal browser-related data. It also spawns a relay channel using WebSocket to accept operator commands and report the status back to the same endpoint. The commands allow the threat actor to remotely control the browser and facilitate key presses, mouse clicks, scrolling, navigation, and tab management.<\/p>\n<p>To avoid the headless sessions from being flagged as automation by the sites visited by the malware, the module injects a script that patches several browser fingerprinting APIs. It has no persistence of its own and runs under the main payload. <\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/corelight-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjuvAqH13TTYyJD3aI-pJcYl54BoxQWMHc2aFwW2HbYUa5IKCjvHlzpzkFwXLTuV8aytky8kqLBgkoOtC8VQM5CGR0N5BXBl8RSXl-PYx_vIPbiLywiqXIvTPmm18cdEm_C0heVB-3U8zfG7K27RCAurtJ7OvxEyfQ0sVV_RRx1N4ZMWkqKgEBmkcDgjD6I\/s728-e100\/code-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>\u00abThe operator receives a live screencast of the session at around 3fps and can drive it with a full input set: keyboard, mouse, scroll, navigation and tab management,\u00bb Jamf said. \u00abThese are translated into CDP calls against the headless browser in real time. This is a hands-on-keyboard hidden browser session, not an automated dump.\u00bb<\/p>\n<p>\u00abIn effect, the remote_stream command turns an infected host into a live, operator-driven browser running the victim&#8217;s authenticated sessions, which is a materially different level of access from file collection.\u00bb<\/p>\n<p>While the overall objectives of the malware are consistent with other stealers like Atomic Stealer, MacSync, and CrashStealer, three different aspects set it apart: a builder-driven configuration, operating system version-branched logic that reaches for macOS bypasses already patched by Apple, and a remote-control second stage that allows attackers to steal user cookies and evade detection through a stealth script that patches browser fingerprinting APIs.<\/p>\n<p>AmnesiaStealer gets its name from a login page located at the root of the C2 host with the name \u00abAmnesia Panel.\u00bb A failed login returns an error message in Russian, urging users to provide a correct login or password to sign in to the operator.<\/p>\n<p>\u00abAmnesiaStealer sets out to harvest credentials, browser data, and live sessions from macOS users, and it delivers on some of that more than the rest,\u00bb Jamf said. \u00abA working collector paired with a working browser-hijack stage, wrapped around a few dated bypasses, is what makes it worth tracking.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Cybersecurity researchers have disclosed details of a new macOS-oriented, Rust-based information stealer called AmnesiaStealer that&#8217;s capable of hijacking Chromium web browsers to steal session data. The multi-stage stealer is spread&hellip;<\/p>\n","protected":false},"author":1,"featured_media":2413,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[3058,622,265,2301,425,2672,774,2277,421,1255],"class_list":["post-2412","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-amnesiastealer","tag-attackers","tag-browser","tag-chromium","tag-control","tag-give","tag-hijacks","tag-live","tag-macos","tag-sessions"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2412","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2412"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2412\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/2413"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2412"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2412"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2412"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}