AmnesiaStealer: New Rust-Based macOS Malware Hijacks Chromium Sessions for Live Browser Control

Cybersecurity researchers have uncovered a new macOS-oriented, Rust-based information stealer called AmnesiaStealer that hijacks Chromium web browsers to steal session data and provide attackers with live, interactive control over the victim’s browser. The multi-stage stealer is distributed via a counterfeit GitHub download page titled “Download for macOS,” which uses a ClickFix-style lure to trick users into copying and pasting a Base64-encoded command into the macOS Terminal.

According to Jamf Threat Labs, the attack chain unfolds in three distinct stages. The first stage is a shell script that downloads and launches the payload. The second stage is a Rust infostealer that harvests data from the Keychain, browsers, Apple Notes, and Telegram. The third stage, called stream_module, is fetched on command and gives the operator hidden, interactive control of the victim’s browser.

The Rust payload performs host reconnaissance and geolocation profiling, and displays a native prompt to capture the system password under the guise of an installer. The entered password is validated against the local directory service via dscl to ensure only the correct password is exfiltrated. If the check fails, it triggers a dialog loop with the message “Incorrect password. Please try again.” until the correct password is entered. The captured password is then reused throughout the chain, piped into sudo -S for privileged reads, passed to security unlock-keychain -p, and written to disk in cleartext.

The stealer targets 16 Chromium-family browsers, including Google Chrome, Brave, Arc, and Microsoft Edge, to gather Cookies, Login Data, Web Data, History, Bookmarks, and other sensitive data. It also steals cookies from Safari using a TCC bypass flaw (CVE-2020-9771) on macOS Catalina. The malware establishes persistence via a root LaunchDaemon that impersonates Apple’s crash reporting service.

Furthermore, the “remote_stream” command issued by the C2 server triggers the first stage payload to fetch and execute a second Rust binary that enables interactive remote control over the Chrome DevTools Protocol (CDP). This module supports seven Chromium-family browsers and launches the browser in headless mode, allowing the operator to receive a live screencast at around 3fps and drive the session with keyboard, mouse, scroll, navigation, and tab management commands. To avoid detection, the module injects a script that patches several browser fingerprinting APIs.

AmnesiaStealer gets its name from a login page located at the root of the C2 host with the name “Amnesia Panel.” A failed login returns an error message in Russian. The malware’s capabilities set it apart from other stealers like Atomic Stealer, MacSync, and CrashStealer due to its builder-driven configuration, OS version-branched logic, and remote-control second stage.