AmnesiaStealer Uses ClickFix to Steal macOS Data and Hijack Browser Sessions
Summary
Jamf Threat Labs analyzed AmnesiaStealer, a three-stage macOS infostealer spread through ClickFix. It collects credentials and data, while a second module enables hidden, operator-controlled browser sessions; several attempted macOS bypasses failed in testing.
Key points
- A counterfeit GitHub download page uses ClickFix to trick visitors into pasting a command into Terminal, which downloads and launches the malware.
- The Rust-based first stage targets keychains, Chromium browser data, Apple Notes, Telegram sessions, documents and wallet-extension data; it also installs a LaunchDaemon for persistence.
- The malware prompts for the user's login password and validates it locally. Jamf observed it using the password to unlock keychains and collect protected data.
- On macOS 26, attempted Safari-cookie and TCC database bypasses failed. The researchers also found the malware's destructive Chrome Safe Storage key rewrite is conditional and can make previously saved browser data undecryptable.
- A remotely launched second stage clones a browser profile and provides hidden, live browser control through the Chrome DevTools Protocol. In lab testing, it exported plaintext cookies through the browser.
- The researchers found the second stage waits for operator commands and does not persist independently; several older macOS bypass techniques in the malware were ineffective in their testing.
Article Details
- Attack Vectors
- ClickFix lure on a counterfeit GitHub download page instructs macOS users to paste a command into Terminal; the command downloads and launches the first-stage payload.
- The first-stage payload collects credentials and files, stages them locally, and uploads the archive to the C2 infrastructure.
- A task from the panel triggers retrieval and execution of a second-stage module, which clones the victim's Chromium profile and enables hidden, operator-controlled browser sessions.
- Defensive Notes
- Jamf recommends configuring Jamf for Mac threat prevention, advanced threat controls, and web protection to Block and Report to help prevent similar threats.
- The article identifies browser Safe Storage entries being deleted and rewritten through the security command-line tool as a high-value detection opportunity.
- The observed sample's APFS snapshot and TCC database bypass attempts failed on macOS 26; the article reports that the sample's debug strings record those failures.
- Monitor for suspicious LaunchDaemon installation, collection and archiving of browser and user data, and uploads to the identified C2 infrastructure.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | debug[.]allllowef[.]space | C2 host serving the Amnesia Panel, bot API, payload archive, and upload endpoint. |
| SHA256 | de5748aac4a4d4cb48cf050652679e6bc49eda33d9ffaa0d280b578122fab55a | SHA-256 hash of the AmnesiaStealer Stage 1 payload analyzed in the article. |
| SHA256 | e853748ca8f9a5a9168263617409a9039ab09f4ffc7d860374c1e3b0b67b31a5 | SHA-256 hash of the AmnesiaStealer Stage 2 stream module analyzed in the article. |
| URL | hxxps[:]//github[.]aoitour[.]com | Counterfeit GitHub download page used to deliver the ClickFix lure. |
MITRE ATT&CK
T1005 · Data from Local SystemThe malware collects local browser data, notes, Telegram session data, documents, and keychain files.T1041 · Exfiltration Over C2 ChannelThe malware uploads collected data to its C2 endpoint.T1056.002 · GUI Input CaptureThe malware presents a native Installer-style password prompt and validates the entered password locally.T1059.002 · AppleScriptThe embedded AppleScript collects Apple Notes, Telegram data, Safari data, and keychain files.T1059.004 · Unix ShellThe first-stage shell script downloads and launches the payload; the malware also runs shell commands during collection and cleanup.T1074.001 · Local Data StagingCollected data is placed in a staging directory under /tmp before being archived and uploaded.T1082 · System Information DiscoveryThe payload gathers the macOS version, hardware identifiers, serial number, and system information.T1105 · Ingress Tool TransferStage 1 fetches and launches the Stage 2 stream module from the C2 infrastructure when commanded.T1185 · Browser Session HijackingThe Stage 2 module clones the victim's browser profile and gives the operator hidden, interactive control of the logged-in browser session.T1204.004 · Malicious Copy and PasteThe ClickFix lure instructs victims to paste a supplied command into Terminal and run it.T1539 · Steal Web Session CookieThe Stage 2 module exports browser cookies, including decrypted cookie values obtained through the Chrome DevTools Protocol.T1543.004 · Launch DaemonThe malware installs a root LaunchDaemon configured with KeepAlive and RunAtLoad for persistence.T1555.001 · KeychainThe malware unlocks and copies macOS login and data-protection keychain files.T1555.003 · Credentials from Web BrowsersThe malware collects Chromium credential databases and browser profile data, including saved-login data.T1560.001 · Archive via UtilityThe malware archives its staging directory using ditto before exfiltration.
CVE
People
Malware
AmnesiaStealerdown and launches a payload. This malware has been seen in the wild and we track it under the name AmnesiaStealer, after the Amnesia Panel backend it reports to. The same name appears in the key that decrypts itsAtomic (AMOS)Its objectives overlap with families such as Atomic (AMOS), MacSync and CrashStealer. Three traits set it apart: a builder-driven configuration, OS version-branched logic that reaches for patched macOS bypasses, and theCrashStealerIts objectives overlap with families such as Atomic (AMOS), MacSync and CrashStealer. Three traits set it apart: a builder-driven configuration, OS version-branched logic that reaches for patched macOS bypasses, and theMacSyncIts objectives overlap with families such as Atomic (AMOS), MacSync and CrashStealer. Three traits set it apart: a builder-driven configuration, OS version-branched logic that reaches for patched macOS bypasses, and the
Products
Apple NotesThe second is a Rust infostealer that harvests the keychain, browsers, Apple Notes and Telegram.ArcSixteen Chromium-family browsers are targeted including Chrome, Brave, Arc and Edge. Per profile, across Default and Profile 1 through Profile 3, it copies Cookies, Login Data, Login Data For Account, Web Data, History,BraveSixteen Chromium-family browsers are targeted including Chrome, Brave, Arc and Edge. Per profile, across Default and Profile 1 through Profile 3, it copies Cookies, Login Data, Login Data For Account, Web Data, History,Google ChromeCollects Chromium databases, Apple Notes and documents; destructively rewrites the Chrome Safe Storage key if browser-key recovery returns nothing on macOS 26macOSJamf Threat Labs has discovered a new multi-stage macOS infostealer distributed through ClickFix: a counterfeit GitHub "Download for macOS" page that lures the visitor into pasting a command into Terminal, which quietlyMicrosoft EdgeThe module supports seven Chromium-family browsers: Chrome, Brave, Microsoft Edge, Arc, Opera, Vivaldi and Chromium. One implementation covers all of them because they are Chromium forks that share the same DevToolsSafariNotes and NotesMedia subfolders, then uses Finder's duplicate command for the remaining items: Safari cookies, a Notes duplicate retry for anything cat missed, Notes attachments under a hard 12 MB cumulativeTelegramThe second is a Rust infostealer that harvests the keychain, browsers, Apple Notes and Telegram.