cyber.hendryadrian.com
Threat Research · securityweek.com

AmnesiaStealer macOS Malware Uses ClickFix to Steal Data and Control Browser Sessions

· Original article ↗

Summary

Jamf reports that ClickFix attacks use a fake GitHub download page to deliver AmnesiaStealer, which steals data from macOS systems and can provide interactive control of browser sessions.

Key points

  • Jamf reports that a counterfeit GitHub download page tricks victims into pasting a command into Terminal, starting a three-stage AmnesiaStealer infection chain.
  • The Rust-based stealer collects keychains, browser databases, Apple Notes, and documents, then archives and sends the data to its command-and-control server.
  • AmnesiaStealer attempts TCC bypasses, including CVE-2020-9771, to access Safari cookies and the TCC database; on macOS 26, the attack requires Full Disk Access for Terminal or the malware process.
  • The malware installs a LaunchDaemon for persistence and can overwrite browser Safe Storage keys, potentially making previously saved passwords and cookies unrecoverable.
  • On demand, a stream module launches a headless browser using the Chrome DevTools Protocol, allowing an operator to view and interact with the victim’s browser session.
  • Jamf says the malware targets six Chromium-based browsers, including Chrome, Brave, Arc, and Edge.

Article Details

Attack Vectors
  • Recent ClickFix attacks used a counterfeit GitHub download page to persuade victims to paste a command into Terminal.
  • A shell script fetched and executed the AmnesiaStealer payload.
  • When it received a remote_stream command, AmnesiaStealer downloaded and ran a module that launched a headless copy of the victim’s browser for interactive control.

MITRE ATT&CK

T1005 · Data from Local SystemAmnesiaStealer harvests keychains, browser databases, Apple Notes, and documents from the victim’s system.T1041 · Exfiltration Over C2 ChannelAmnesiaStealer sends the archived harvested data to its command-and-control server.T1059.004 · Unix ShellThe infection chain begins with a command pasted into Terminal and uses a shell script to fetch and execute the payload.T1105 · Ingress Tool TransferThe shell script fetches the AmnesiaStealer payload, and the malware downloads its stream module when commanded.T1113 · Screen CaptureThe on-demand stream module provides the operator with a live screencast of the victim’s browser session.T1539 · Steal Web Session CookieAmnesiaStealer attempts to obtain Safari cookies through a TCC bypass and harvests browser cookies.T1543.001 · Launch AgentAmnesiaStealer installs a LaunchDaemon for persistence.T1548.006 · TCC ManipulationThe malware attempts TCC framework bypasses to access Safari cookies and the TCC database.T1555.001 · KeychainThe malware copies login and data-protection keychains and accesses saved credentials in the login keychain.T1555.003 · Credentials from Web BrowsersThe malware harvests Chromium-based browser databases and replaces each browser’s Safe Storage key with an attacker-controlled value.T1560.001 · Archive via UtilityThe malware archives harvested data before sending it to its command-and-control server.

CVE

CVE-2020-9771Apple · Mac os xTo steal Safari cookies and access the TCC database, the malware uses an old TCC bypass (CVE-2020-9771).

Malware

AmnesiaStealerThe fake download page lures victims into pasting a command into Terminal, which leads to the newly discovered AmnesiaStealer being installed.

Products

Apple Notesit locally, copies login and data-protection keychains, and harvests Chromium-based browser databases, Apple Notes, and documents.ArcThe information stealer targets six Chromium-based browsers, including Chrome, Brave, Arc, and Edge, and was seen overwriting the per-browser Safe Storage key in the login keychain with an attacker-controlled value,BraveThe information stealer targets six Chromium-based browsers, including Chrome, Brave, Arc, and Edge, and was seen overwriting the per-browser Safe Storage key in the login keychain with an attacker-controlled value,EdgeThe information stealer targets six Chromium-based browsers, including Chrome, Brave, Arc, and Edge, and was seen overwriting the per-browser Safe Storage key in the login keychain with an attacker-controlled value,Google ChromeThe information stealer targets six Chromium-based browsers, including Chrome, Brave, Arc, and Edge, and was seen overwriting the per-browser Safe Storage key in the login keychain with an attacker-controlled value,macOSA multi-stage Rust-based macOS information stealer has been distributed through a counterfeit GitHub download page in recent ClickFix attacks, Jamf reports.SafariAmnesiaStealer also attempts two Transparency, Consent, and Control (TCC) framework bypasses to gain Safari cookie and full disk access, archives the harvested data and sends it to the command-and-control (C&C) server,

Related Articles