cyber.hendryadrian.com
Threat Research · bleepingcomputer.com

AmnesiaStealer Uses Cloned Chromium Profiles to Hijack macOS Browser Sessions

· Original article ↗

Summary

Jamf researchers analyzed AmnesiaStealer, a macOS infostealer distributed through ClickFix lures. Its stream_module clones Chromium profiles and uses CDP to let operators control victims’ authenticated browser sessions remotely.

Key points

  • AmnesiaStealer is distributed through ClickFix campaigns using a fake GitHub download page and a password-protected ZIP archive.
  • The malware can collect browser profiles, passwords, keychain data, Apple Notes, documents, Telegram sessions, and cryptocurrency wallet information.
  • Its stream_module clones profiles from seven Chromium-based browsers and launches a hidden headless browser with the victim’s authentication state.
  • Two WebSocket channels support operator commands and communication with the local browser through the Chrome DevTools Protocol (CDP).
  • Operators can navigate sites, interact with pages, manage tabs, and import or export cookies; the malware also sends live screencast frames.
  • Jamf says this appears to be the first documented macOS malware combining cloned Chromium profiles with CDP-based live remote control.
  • Users are advised not to run online terminal commands they do not understand.

Article Details

Attack Vectors
  • ClickFix lures use a fake GitHub download page to prompt users to run a command.
  • The command executes a shell-script loader that downloads and launches a password-protected ZIP containing the AmnesiaStealer Mach-O payload.
  • The malware copies Chromium browser profiles, including authentication state, into a hidden headless browser and connects to the operator through WebSocket channels for live session control.
Defensive Notes
  • Users are advised not to execute terminal commands found online unless they fully understand them.

MITRE ATT&CK

T1005 · Data from Local SystemThe malware collects local browser profiles, Apple Notes, documents, system information, and wallet data.T1041 · Exfiltration Over C2 ChannelThe malware transmits live browser screencast frames over its WebSocket connection to the operator relay.T1059.004 · Unix ShellThe ClickFix command executes a shell-script loader that downloads and launches the AmnesiaStealer archive.T1071.001 · Web ProtocolsWebSocket channels connect the malware to an operator relay and to the local headless Chromium instance.T1105 · Ingress Tool TransferThe shell-script loader downloads the password-protected ZIP archive containing the AmnesiaStealer Mach-O payload.T1113 · Screen CaptureThe browser-control module sends screencast frames from the victim’s live browser session to the operator.T1539 · Steal Web Session CookieThe malware collects browser cookies and uses cloned profiles to operate victims’ authenticated sessions.T1555.001 · KeychainAmnesiaStealer collects macOS Keychain data after capturing the victim’s macOS password.T1555.003 · Credentials from Web BrowsersThe malware collects saved logins and other profile data from Chromium-based browsers.

Malware

AmnesiaStealerAmnesiaStealer is a new macOS information-stealing malware spread through ClickFix lures, including fake GitHub download pages, and it can steal passwords, browser data, keychain items, and cryptocurrency walletATOMICResearchers at Jamf, an Apple device management and security company, analyzed AmnesiaStealer’s distribution and found that it used the same template previously used to spread the Atomic and MacSync infostealers.MacSyncResearchers at Jamf, an Apple device management and security company, analyzed AmnesiaStealer’s distribution and found that it used the same template previously used to spread the Atomic and MacSync infostealers.

Products

Apple NotesThe malware steals browser profiles, passwords, keychain data, Apple Notes, documents, and wallet information.Arcuser profiles in seven Chromium-based browsers, including Google Chrome, Microsoft Edge, Vivaldi, Arc, Opera, Brave, and Chromium, because they share the same DevTools Protocol, launch flags, and cookieBraveprofiles in seven Chromium-based browsers, including Google Chrome, Microsoft Edge, Vivaldi, Arc, Opera, Brave, and Chromium, because they share the same DevTools Protocol, launch flags, and cookie encryption.ChromiumIts standout feature is a stream_module that clones a victim’s Chromium profile and lets attackers interact live with authenticated browser sessions through a hidden headless browser.Google Chromestream_module can duplicate user profiles in seven Chromium-based browsers, including Google Chrome, Microsoft Edge, Vivaldi, Arc, Opera, Brave, and Chromium, because they share the same DevToolsmacOSAmnesiaStealer is a new macOS information-stealing malware spread through ClickFix lures, including fake GitHub download pages, and it can steal passwords, browser data, keychain items, and cryptocurrency walletMicrosoft Edgestream_module can duplicate user profiles in seven Chromium-based browsers, including Google Chrome, Microsoft Edge, Vivaldi, Arc, Opera, Brave, and Chromium, because they share the same DevTools Protocol, launchOperauser profiles in seven Chromium-based browsers, including Google Chrome, Microsoft Edge, Vivaldi, Arc, Opera, Brave, and Chromium, because they share the same DevTools Protocol, launch flags, and cookie encryption.TelegramThe malware captures the victim’s macOS password and uses it to collect keychain data, as well as browser profiles, Apple Notes, Telegram sessions, documents, system information, and cryptocurrency wallet data.Vivaldican duplicate user profiles in seven Chromium-based browsers, including Google Chrome, Microsoft Edge, Vivaldi, Arc, Opera, Brave, and Chromium, because they share the same DevTools Protocol, launch flags, and cookie

Related Articles