AmnesiaStealer: macOS Malware Hijacks Authenticated Browser Sessions
Runtime Rebel analysts have identified a new macOS information-stealing malware dubbed AmnesiaStealer, which employs a novel technique to hijack browser sessions through remote control. Distributed via ‘ClickFix’ campaigns, this threat poses a significant risk by allowing attackers to interactively control victims’ web browsers using their existing authenticated sessions. This capability provides a materially different level of access compared to traditional file exfiltration, enabling adversaries to operate online portals and services as the victim directly, according to BleepingComputer.
Technical Analysis: AmnesiaStealer’s Advanced Session Hijacking
AmnesiaStealer is primarily distributed through ClickFix campaigns, which leverage fake GitHub download pages. These campaigns trick users into downloading a password-protected ZIP archive. A shell-script loader, executed as part of the ClickFix attack, then downloads and launches this archive, unleashing the AmnesiaStealer Mach-O payload on the victim’s system. Researchers at Jamf noted that this distribution template has previously been used to spread other macOS infostealers like Atomic and MacSync, indicating a potential operational link or shared tooling among threat actors.
Upon execution, AmnesiaStealer demonstrates extensive data collection capabilities. It targets sensitive information across 16 Chromium-based web browsers, including:
- Passwords and saved logins
- Browser history, bookmarks, and extensions
- Cryptocurrency wallet details (by enumerating extensions and IndexedDB data)
- Apple Notes and documents
- Keychain data (after capturing the victim’s macOS password)
- Telegram sessions and general system information
The most distinctive feature of AmnesiaStealer is its stream_module, activated by the remote_stream command. This module enables the attacker to duplicate a victim’s Chromium browser profile, including its authentication state, and load it into a hidden, headless browser instance on the infected macOS system. This approach allows the attacker to bypass multi-factor authentication and other controls, as they are effectively operating within the victim’s already authenticated session, preserving all associated identifiers (browser, host, network).
The stream_module can duplicate user profiles in at least seven Chromium-based browsers, including Google Chrome, Microsoft Edge, Vivaldi, Arc, Opera, Brave, and Chromium. It achieves this by launching the legitimate browser executable in headless mode with specific command-line switches that weaken browser defenses. A WebSocket channel is then established, connecting to the operator’s relay. This channel sends JSON registration messages and allows the operator to issue commands such as navigation, mouse clicks, and tab management, receiving live screencast frames (around 3 frames per second) and status updates. A second WebSocket channel directly accesses the headless Chromium instance via its webSocketDebuggerUrl, leveraging the Chrome DevTools Protocol (CDP) for intricate control over the browsing session, including exporting/importing cookies and full interaction with online portals.
While CDP has been abused by other malware families like Chaos ransomware and Chaes malware, AmnesiaStealer is believed to be the first documented macOS malware to combine a cloned Chromium profile with live, CDP-based remote control. This combination allows for a level of interactive session hijacking that significantly elevates the threat.
Actionable Recommendations for macOS Security
Defenders seeking to mitigate macOS info stealer threats like AmnesiaStealer should prioritize several key actions to protect against such sophisticated attacks:
- User Education: Train users to be highly suspicious of unsolicited downloads, especially those from non-official sources or requiring password entry. Emphasize the dangers of executing terminal commands found online without full comprehension of their function.
- Endpoint Detection and Response (EDR): Implement and configure EDR solutions capable of detecting unusual process execution, particularly for shell scripts and legitimate browser executables launched in headless mode with suspicious command-line flags. This can help detect AmnesiaStealer ClickFix attacks early in the infection chain.
- Regular Software Updates: Keep macOS and all installed browsers updated to their latest versions. While AmnesiaStealer relies on social engineering, up-to-date systems often contain security enhancements that can hinder malware operations or exploitation attempts.
- Review Browser Extensions: Regularly audit and remove unnecessary or suspicious browser extensions. Malware often uses extensions as a vector or to gain persistence.
- Principle of Least Privilege: Limit user permissions where possible. Restrict the ability to execute unknown scripts or install applications from untrusted sources.
Effective defense against AmnesiaStealer requires a layered security approach, focusing on prevention, detection, and user awareness. The ability for attackers to gain live, interactive control over authenticated sessions underscores the critical need for vigilance and advanced security measures.
Related: ClickFix Attack Deploys macOS Infostealer for Crypto Theft, ClickLock macOS Stealer: How Attackers Coerce Victims via App Kill Loops