New macOS Infostealer: AmnesiaStealer Raises Alarms Amid ClickFix Attacks
Researchers from Jamf have raised alerts about a newly emerging macOS infostealer, identified as AmnesiaStealer, which is being disseminated through ClickFix social engineering tactics. This sophisticated malware is crafted in Rust and incorporates multiple stages and objectives following its successful infection of a victim’s device. Notably, AmnesiaStealer is designed to harvest an array of sensitive information, including user credentials, browser data, and live session information.
What sets AmnesiaStealer apart from other macOS infostealers, such as Atomic (AMOS), MacSync, and CrashStealer, is its unique capabilities that specifically target macOS, rendering it a distinct threat. The researchers have highlighted its built-in OS version-branched logic, which allows it to exploit vulnerabilities in macOS that have been patched by Apple, illustrating its evolution in bypassing modern security measures. The malware also includes a remote-controlled second stage, providing operators with concealed and interactive control over the victim’s browser, significantly enhancing its threat profile.
The Mechanics Behind AmnesiaStealer Campaigns
The Jamf report, published on August 13, details the methodology employed by attackers to distribute AmnesiaStealer to macOS users through ClickFix. In ClickFix-style assaults, the user unwittingly enters a command that many antivirus and cybersecurity defenses incorrectly categorize as legitimate. Attackers effectively utilize counterfeit error messages or verification prompts to coax victims into copying, pasting, and executing malicious scripts.
This manipulation preys on users’ instincts to troubleshoot issues independently instead of seeking help from their IT departments, thereby circumventing existing security precautions and enabling self-inflicted infections among victims. This tactic has gained popularity, with research indicating that ClickFix has risen to prominence as a leading method of malware distribution in recent years.
AmnesiaStealer’s ClickFix lure is characterized by a fake GitHub download page, which presents users with a "Terminal installation" box, purportedly for the convenience of advanced users. Users are then guided through a series of numbered instructions, directing them to open and install the Terminal.
When users click the ‘copy’ button, a base64 blob is generated that decodes into a single command responsible for retrieving a script. This script is notably silent and self-deleting, ensuring the execution of the AmnesiaStealer binary and subsequently commencing a string of malicious activities aimed at exfiltrating sensitive information.
The malware’s first step involves silencing the device’s sound system to obscure its data theft activities. Sound suppression is crucial as some data collection is conducted through Finder, which traditionally emits a sound for each duplicated file. Following this stealthy initiation, AmnesiaStealer conducts thorough reconnaissance across various software, hardware, and display data types.
Initially, the malware targets data from applications like Apple Notes and Telegram, carefully writing commands to evade macOS permission prompts. It then prompts the victim to enter their password, which is validated locally. These captured credentials are subsequently employed to unlock encrypted data-protection keychain files. The motives behind this data collection remain unclear, raising concerns about potential future misuse.
Once the information is collected, it is staged in a directory, archived, and set for exfiltration. In the next phase, a second binary is activated, granting threat actors remote access to victims’ browsers. The malware is compatible with seven Chromium-family browsers, including Chrome, Brave, Microsoft Edge, Arc, Opera, Vivaldi, and Chromium.
This operation is notably covert, as it duplicates the victim’s browser profile and takes control of the cloned instance. The original browser remains unaffected, allowing the attacker to monitor a live screencast of the browsing session. Threat actors can manipulate the compromised browser using a full range of input functions—including keyboard, mouse, scroll, navigation, and tab management—while stealthily stealing browser cookie data in plaintext via the DevTools protocol. This tactic effectively evades detection by stealthily injecting a script that prevents the session from being flagged as automated by visited sites.
Jamf emphasizes the importance for macOS users to implement robust preventive measures, recommending configurations that enhance threat prevention, advanced threat controls, and web protection. Such proactive steps can greatly assist in blocking and reporting potential threats, mitigating the risks posed by emerging malware like AmnesiaStealer. As the digital landscape continues to evolve, awareness of and preparedness against such threats will be crucial for maintaining cybersecurity hygiene.