AmnesiaStealer: A New Era of macOS Infostealer Threats
AmnesiaStealer has emerged as a formidable malware threat specifically engineered for macOS systems. Unlike traditional infostealers, this multi-stage infostealer, crafted in Rust, unveils a new approach to cyberattacks by providing attackers with covert, interactive control over victims’ authenticated sessions within Chromium-based browsers.
Distribution Method
The distribution of AmnesiaStealer is facilitated through a social-engineering campaign known as ClickFix, which cunningly directs unsuspecting users to counterfeit GitHub download pages. Rather than delivering a legitimate application, these deceptive sites urge visitors to copy and execute a command in Terminal. This command initiates a complex shell-based infection chain that efficiently downloads, extracts, signs, and executes the malware, while also deleting installation artifacts to obscure traces of the attack.
Analyzing the Malware’s Features
One of the most alarming characteristics of AmnesiaStealer is its dedicated browser-streaming component. This feature enables the malware to clone a logged-in browser profile, giving remote operators access via the Chrome DevTools Protocol (CDP). Jamf’s analysis of the campaign has been characterized as a significant evolution in the macOS infostealer tradecraft. Previously, traditional infostealers primarily focused on copying browser databases, cookies, saved passwords, and autofill information for offline processing. In contrast, AmnesiaStealer utilizes this collection phase merely as a precursor for more lethal attacks.
The malware’s Stage 1 payload broadly targets 16 different Chromium-family browsers, seeking to harvest essential data such as cookies, login databases, browsing history, bookmarks, extension information, Local State files, and browser preferences. Additionally, it searches for Safe Storage keys stored in the victim’s macOS login keychain, which could potentially unlock encrypted browser artifacts.
Once its operators give the go-ahead, AmnesiaStealer downloads a Stage 2 streaming module that supports seven Chromium-based browsers. This module goes a step further by creating a duplicated browser profile and launching it in a hidden, headless browser instance, thus facilitating remote interaction through the CDP.
Implications for Security
The capabilities afforded to attackers by AmnesiaStealer are both extensive and alarming. They can browse websites using the victim’s authenticated sessions, manage and open new tabs, simulate input actions like mouse clicks and keystrokes, observe browser outputs, and even export plaintext cookies while importing them into different browser sessions. The Jamf researchers highlighted that the malware has the ability to harvest credentials, browser data, Apple Notes information, Telegram session details, documents, wallet-related artifacts, and macOS Keychain contents. Intriguingly, the attacker does not need to visibly seize control of the victim’s desktop or disrupt their ongoing browser activities.
This poses a significant threat, especially to users logged into corporate SaaS platforms, email accounts, cloud services, cryptocurrency platforms, developer portals, and financial accounts. For instance, while a stolen password might trigger multi-factor authentication (MFA), an active browser session could allow adversaries to bypass this security by continuing access to previously authenticated accounts until those sessions are either revoked or they expire.
Advanced Techniques
AmnesiaStealer conducts an initial profiling of the compromised host and prompts the user with a native installer-style password request. The provided password is then validated locally, granting the malware access to unlock the macOS login keychain and allowing it to tap into sensitive credentials and encryption materials. Information collected is staged, archived, and transmitted to attacker-controlled infrastructure, while the malware achieves persistence using a LaunchDaemon disguised as an Apple crash-reporting component. This process includes the removal of specific files and installation artifacts, significantly reducing the potential traces left for investigators.
Furthermore, researchers have recognized builder-generated configurations consisting of encrypted campaign settings, unique build identifiers, and execution paths based on macOS versions. This design feature enables operators to produce variants of the malware without altering the overall functionality aimed at collecting data and exploiting browser sessions.
Evolving Threat Landscape
AmnesiaStealer shares objectives with other macOS threats like Atomic Stealer, MacSync, and CrashStealer, adopting a counterfeit GitHub lure pattern akin to the tactics seen in previous Atomic and MacSync operations. However, its unique browser-streaming feature marks a pivotal shift; the browser is transformed from a mere repository of stolen data into a dynamically controlled foothold for attackers.
To counter such malware threats, defenders are advised to prioritize behavioral detection over static indicators, as malware capable of rapid changes can easily obfuscate its footprints. Security personnel should scrutinize any terminal activities generated after visiting software download pages, unusual use of terminal commands like curl, and unexpected access to the login keychain. Identifying new LaunchDaemon entries disguised as regular Apple components, as well as hidden Chrome executions, also requires immediate attention.
As a protective measure, users are counseled to refrain from executing terminal commands originating from dubious websites, social media posts, or fraudulent GitHub pages. Organizations can further bolster their defenses by enforcing application controls, scrutinizing persistence locations, and swiftly revoking any activated browser sessions when there is a suspicion of macOS credential theft.
In summary, the advent of AmnesiaStealer underscores a critical shift in the macOS cybersecurity landscape: defending passwords alone is insufficient. It’s essential for security protocols to also safeguard authenticated browser sessions, as they increasingly act as gateways to a user’s digital identity in today’s interconnected world.