DEV Community

Anoymask
Anoymask

Posted on

AmnesiaStealer: macOS Infostealer that Hijacks In-Browser Sessions via ClickFix

#security #threatintel

AmnesiaStealer: macOS Infostealer that Hijacks In-Browser Sessions via ClickFix

1. Basic Information

  • Severity: High
  • Article Title: AmnesiaStealer: a multi-stage Rust-based macOS infostealer that hijacks Chromium browsers
  • Publisher: Jamf Threat Labs
  • Publication Date: 2026-08-13
  • Update Date: N/A
  • Original Source: Original
  • Related Sources: SecurityWeek
  • Malware: AmnesiaStealer, stream_module
  • Groups: None
  • CVEs: CVE-2020-9771 (Old TCC/APFS bypass. Failed in Jamf testing on current macOS 26)
  • Products: macOS, Chromium-based browsers, Apple Keychain, Apple Notes, Telegram

2. Executive Summary

AmnesiaStealer uses a fake GitHub ClickFix page to launch a Rust-based stealer. It steals login passwords, Keychain data, documents, and browser information. It also copies real browser profiles and uses CDP (Chrome DevTools Protocol) to secretly and remotely control active browser sessions.

3. Attack Flow

Stage 0: ClickFix and Payload Launch

  1. A fake GitHub page tricks the user into pasting a command into the Terminal.
  2. The system uses curl to download a shell script and runs it with nohup bash.
  3. A password-protected ZIP file (password dulin) is saved to /tmp and extracted.
  4. The system runs xattr -cr, adds execute permissions, applies an ad-hoc signature, and starts a Rust universal Mach-O binary.
  5. Temporary files and the shell history are deleted.

Stage 1: Credential Theft, Data Exfiltration, and Persistence

  1. A native dialog asks for the macOS login password. The malware verifies it locally using dscl or sudo -S -v.
  2. The password is saved in plain text in a staging area and at ~/.pwd, then used to try to unlock the Keychain.
  3. The malware collects data from the Keychain, Apple Notes, Telegram, documents, 16 types of Chromium profiles, crypto wallets, and system info.
  4. It archives the staging folder (/tmp/<25 characters>) using ditto and sends it to the C2 server at /send/.
  5. It uses the stolen password to create a root LaunchDaemon named com.apple.ReportCrash.agent_<digits>.

Stage 2: Hidden Browser Session Hijack

  1. When it receives the C2 command remote_stream, it downloads an extra stream_module.
  2. It copies the victim's Chromium profile to ~/.local/share/.stream/profiles/<browser>.
  3. It launches the real browser in headless mode with remote debugging enabled.
  4. It uses a WebSocket relay and Chrome DevTools Protocol (CDP) to control tabs, the mouse, the keyboard, and navigation.
  5. It exports plain text cookies using Network.getAllCookies and can import them into another session using Network.setCookies.

Bypasses and Destructive Fallbacks That Failed on Current macOS

  1. It tries CVE-2020-9771 and TCC database injection, but Jamf's tests on macOS 26 show this fails without Full Disk Access.
  2. If it fails to get the Chrome Safe Storage key, it has a fallback: it deletes existing items and recreates them with a known password.
  3. This fallback can destroy the ability to decrypt existing saved data.

4. Attacker Positioning and Execution

  • Initial lures and C2 servers run on attacker-controlled web and C2 infrastructure.
  • Stage 0 and Stage 1 start with user privileges. After getting the stolen login password, the malware tries to create a root LaunchDaemon.
  • Browser remote control runs using a legitimate Chromium app and an extra module on the victim's Mac. The operator controls it through a WebSocket relay.
  • Root access and Full Disk Access are separate things. Public reports do not state that root access alone automatically grants access to TCC-protected data.

5. What Victims and Administrators See

  • Victims see a GitHub-style download page, instructions to paste into the Terminal, and a macOS-style password dialog.
  • Administrators see curl/bash commands from the Terminal, /tmp/.com.apple.dt.*, ad-hoc signatures, LaunchDaemons, unknown C2 traffic, and headless browsers.
  • On macOS 26, using the security CLI to delete and recreate Chrome Safe Storage creates a strong sign of abnormal activity.
  • Stage 2 actions run inside a legitimate browser process. Because of this, identity providers (IdPs) might see them as normal sessions from the victim's device and IP address.

6. Conditions for Success and Failure

Conditions for Success

  • The user pastes the fake page's command into the Terminal.
  • Download/C2 communications, Mach-O execution, and password entry are allowed.
  • The stolen password is valid, allowing the creation of a LaunchDaemon.
  • The malware can access target browser profiles and cookies.
  • For Stage 2, operator commands and WebSocket relays can reach the target.

Conditions for Failure

  • Blocking fake domains, curl | bash, and Terminal pasting.
  • The user refuses to run the command or enter the password.
  • MDM/EDR blocks unknown Mach-O binaries, ad-hoc signatures, LaunchDaemons, or headless remote debugging.
  • Full Disk Access is missing, and the old TCC bypass fails as seen in Jamf testing.
  • Quick session revocation, password changes, and C2 blocking.

7. What Happens on Success

  • The theft of the macOS login password, Keychain data, documents, Notes, Telegram, wallets, and browser data.
  • Persistence after reboot via a root LaunchDaemon.
  • Remote control of logged-in Chromium sessions and cookie export/import.
  • Loss of access to existing saved information due to the Chrome Safe Storage fallback.
  • Stage 2 capabilities were verified in Jamf's isolated lab. Public reports do not confirm operators using this against real victims yet.

8. Observable Logs

Email

  • Public reports do not show email as the initial vector.

Proxy / SWG / DNS

  • github.aoitour[.]com
  • debug.allllowef[.]space
  • allllowef[.]space
  • shlyapadulina[.]space
  • 138.124.70[.]84
  • 138.124.96[.]160
  • C2 endpoints: /api/bot/join, /api/bot/actions, /send/
  • Browser WebSocket relays

Endpoint / EDR

  • Terminal → curl → bash
  • /tmp/._<digits>.zip
  • /tmp/.com.apple.dt.<digits>
  • xattr -cr, chmod, codesign, nohup
  • dscl, sudo -S -v
  • ~/.pwd, ~/.chost, ~/.botid
  • /Library/LaunchDaemons/com.apple.ReportCrash.agent_<digits>.plist
  • ~/.local/share/.stream/profiles/
  • Chromium --remote-debugging-* flags
  • Chrome Safe Storage changes via the security CLI

Identity / IdP

  • Cookie reuse from the victim's device/IP
  • New sessions created after cookie export
  • Logins to services using reused passwords
  • Active sessions without MFA prompts

SaaS / Cloud

  • C2 uploads
  • SaaS operations performed inside the browser
  • Data access to Telegram, Notes, and similar apps

Network

  • C2 HTTPS traffic
  • WebSockets
  • Outbound traffic from headless Chromium
  • Quick archive uploads

9. Determining Attack Success

Contact Only

  • Viewed the fake page, did not run commands.

User Action

  • Pasted commands into the Terminal or entered the password.

Initial Execution

  • Process and file artifacts for Stage 0 shell and Rust Mach-O.

Malware or Authentication Success

  • C2 join, password validation, or LaunchDaemon creation.

Data Theft or Session Compromise

  • Successful /send/ upload, cookie export, C2 receipt, or use of stolen sessions.

Post-Compromise Confirmation

  • Confirmed Stage 2 module, headless browser, operator commands, or SaaS actions.

10. Investigation Playbook

Trigger

  • Terminal curl | bash execution
  • AmnesiaStealer hashes or domains
  • Fake CrashReporter LaunchDaemon
  • Chrome Safe Storage changes
  • Headless Chromium remote debugging

Initial Verification

  • Identify the target URL, command, execution time, login user, and whether a password was entered.
  • Correlate C2 DNS/Proxy traffic with the process tree.
  • Determine how far the attack reached (Stage 0, 1, or 2).

Endpoint

  • Preserve /tmp, ~/.pwd, the LaunchDaemon, browser profile clones, shell history, and Keychain operations.
  • Collect Mach-O hashes, code signatures, parent/child processes, and network sockets.

Authentication & Cloud

  • Change the macOS password, rotate Keychain/SSO secrets, and revoke all browser and SaaS sessions.
  • Check for SaaS actions and cookie usage from the same device/IP.

Subsequent Actions

  • Look for access to wallets, Telegram, Notes, and documents.
  • Search for additional payloads, operator commands, and credential reuse on other devices.

Containment

  • Isolate the host, block C2 traffic, stop the LaunchDaemon, preserve evidence, and rebuild the system.
  • Rotate passwords, tokens, cookies, and wallet secrets as needed.

Assessment Levels

  • Lure Viewed
  • Command Pasted
  • Payload Executed
  • Password Captured
  • Stealer Exfiltration Confirmed
  • Browser Session Hijack Confirmed

11. Defense and Detection Ideas

Single Events

  • Fake CrashReporter LaunchDaemon
  • ~/.pwd file creation
  • Terminal → curl -s → nohup bash
  • Chrome Safe Storage deletion/recreation
  • Chromium remote debugging flags

Timeline Correlation

  • Fake GitHub view → Terminal paste → ZIP/Mach-O execution → Password dialog → Staging/archive → C2 upload → LaunchDaemon → stream_module → Headless browser

Threat Hunting Focus

  • com.apple.ReportCrash.agent_
  • ~/.local/share/.stream/profiles
  • CDP actions like Network.getAllCookies
  • 15-byte XOR keys or C2 IOCs
  • Stage 1 and Stage 2 SHA256 hashes

Log Gaps

  • Terminal command lines
  • TCC/FDA status
  • Keychain item changes
  • Browser CDP traffic
  • WebSocket payloads
  • File access telemetry

Priority Actions

  • Use MDM to detect Terminal pasting and curl | bash.
  • Control and monitor unknown LaunchDaemons.
  • Restrict browser remote debugging.
  • Shorten session lifetimes and use device binding.
  • Minimize Full Disk Access permissions.

12. Facts, Inferences, and Hypotheses

Facts

  • Jamf confirmed AmnesiaStealer in a real environment.
  • Stage 1 uses a Rust universal Mach-O binary to collect Keychain data, browser data, Notes, Telegram, wallets, and documents.
  • It includes code for root LaunchDaemon persistence using a stolen password.
  • Jamf's macOS 26 tests showed that old TCC bypasses failed without Full Disk Access.
  • Stage 2 successfully tested browser control and cookie exports in an isolated lab.
  • There is no public proof that Stage 2 was used by an operator against a real victim.

Inference

  • Because cookies are used inside the victim's real browser, an IdP's location and device checks alone may not spot unauthorized actions.
  • After password theft, you must check not just the compromised device, but also SaaS apps and VPNs that use the same password.

Hypothesis

  • Correlating high-frequency CDP commands with screencasts (around 3 fps) from a remote browser might help detect hidden session control.

13. MITRE ATT&CK Mapping

  • T1204.004 Malicious Copy and Paste — Confidence: High
  • T1059.004 Unix Shell — Confidence: High
  • T1105 Ingress Tool Transfer — Confidence: High
  • T1056 Input Capture — Confidence: High
  • T1555.001 Credentials from Password Stores: Keychain — Confidence: High
  • T1539 Steal Web Session Cookie — Confidence: High
  • T1560.001 Archive via Utility — Confidence: High
  • T1543.004 Launch Daemon — Confidence: High
  • T1070.004 File Deletion — Confidence: High
  • T1185 Browser Session Cookie — Confidence: Medium (Mapped to session control via CDP)

14. Unknowns and Further Investigation

  • Total victim count, target regions, and threat actor attribution.
  • Whether Stage 2 has been used against real victims.
  • Success rates of TCC bypasses on versions other than macOS 26.
  • Full lists of C2 servers, IOCs, and build differences.
  • Confirmed cases of stolen data and wallet losses.

15. Impact on Security Operations Centers (SOCs)

Development, design, and media teams often use Mac computers, making them potential targets. Organizations need detection strategies that span across ClickFix awareness training, Terminal command lines, LaunchDaemons, browser remote debugging, and session-level activities.

16. Summary by Role

  • For SOC Teams: Track attacks step-by-step from Terminal pasting to LaunchDaemons, C2 uploads, and headless browsers. Avoid confusing root access with Full Disk Access.
  • For IT Administrators: Use MDM and EDR to restrict unknown LaunchDaemons and remote debugging. If an infection happens, revoke passwords, Keychains, and browser sessions all at once.
  • For End Users: Never paste commands into the Terminal based on web page instructions, and never enter passwords into prompt boxes that appear after downloading files.

Top comments (0)