Security researchers at Jamf Threat Labs have identified a new macOS infostealer named AmnesiaStealer that uses a convincing fake GitHub website to trick users into executing a malicious Terminal command.
The campaign combines social engineering, staged malware delivery and browser-session theft. Once installed, AmnesiaStealer can collect sensitive credentials and data from the compromised Mac and can later deploy an additional component capable of remotely controlling the victim's browser session.
Key Highlights
- Malware family: AmnesiaStealer
- Target platform: macOS
- Initial delivery: Fake GitHub download page
- Social-engineering technique: ClickFix
- Malware implementation: Rust
- Steals macOS Keychain data
- Targets Apple Notes and Telegram sessions
- Collects browser data and documents
- Uses a fake macOS installer password prompt
- Additional
stream_moduleenables browser-session control - Uses Chrome DevTools Protocol for browser interaction
- Campaign infrastructure includes
github.aoitour[.]com - Embedded configuration uses the key
4mn3s1a_2o26!xK
Initial Access
The campaign begins with a counterfeit GitHub website designed to closely resemble the legitimate GitHub interface.
The malicious website uses GitHub branding, including a dark theme, Octocat logo and a fake Verified Publisher badge.
Instead of providing a legitimate application download, the page instructs the victim to:
- Open Terminal.
- Copy a displayed command.
- Paste the command into Terminal.
- Press Return.
- Enter their macOS password.
This technique is known as ClickFix, where victims are socially engineered into executing commands themselves.
Malware Installation
After the victim executes the command, a hidden shell script downloads a password-protected ZIP archive.
The malware then:
- Extracts a disguised binary into
/tmp - Removes Apple's quarantine flag
- Launches the payload
- Deletes installation artifacts
Removing the quarantine attribute helps the malware reduce warnings that would otherwise be generated by macOS.
Credential and Data Theft
AmnesiaStealer is designed to collect sensitive information from the compromised Mac.
Observed targets include:
- macOS Keychain
- Apple Notes
- Telegram sessions
- Browser data
- Documents
- System information
- User credentials
The malware also displays a fake native-looking Installer password prompt.
The captured password can then be used to access protected information such as Keychain data.
Browser Session Hijacking
The most significant capability is provided by a component named:
stream_module
This component is reportedly fetched only when instructed by the attacker's control panel.
It can:
- Clone the victim's browser profile
- Launch the browser in headless mode
- Connect through the Chrome DevTools Protocol
- Capture a live browser screencast
- Control mouse input
- Control keyboard input
- Navigate websites
- Operate existing logged-in sessions
This capability could allow an attacker to interact with authenticated browser sessions involving email, banking, social-media and other web applications without obvious changes appearing on the victim's local display.
Command and Control
AmnesiaStealer communicates with an attacker-controlled backend referred to as the Amnesia Panel.
The malware contains an embedded configuration protected using:
4mn3s1a_2o26!xK
The staged architecture allows the attacker to download additional functionality only when required.
This reduces the amount of malicious functionality present during the initial infection and can make static analysis and detection more difficult.
Anti-Analysis and macOS Protections
Researchers identified attempts by the malware to bypass Apple's privacy and security protections.
Some of these techniques rely on older macOS vulnerabilities and bypass methods, including an APFS snapshot bypass associated with techniques from 2020.
On modern versions such as macOS 26, these particular techniques largely fail.
However, the failure of these older bypasses does not prevent the malware from performing its core credential and browser-session theft capabilities.
Detection and Hunting Opportunities
Security teams should monitor for:
- Users visiting suspicious GitHub lookalike domains
- Terminal commands copied from untrusted websites
- Suspicious shell execution from browser-launched processes
- Unknown binaries executed from
/tmp - Removal of macOS quarantine attributes
- Password prompts from unexpected installers
- Unauthorized access to Keychain
- Browser profiles being copied or modified
- Headless Chrome processes
- Unexpected Chrome DevTools Protocol activity
- Browser processes controlled by unknown binaries
- Suspicious access to Telegram session data
- Connections to unknown Amnesia Panel infrastructure
- Unexpected downloads of secondary payloads
Recommended Mitigations
- Educate users never to paste unknown commands into Terminal.
- Block known malicious GitHub lookalike domains.
- Monitor Terminal and shell execution telemetry.
- Monitor suspicious execution from
/tmp. - Detect attempts to remove macOS quarantine attributes.
- Monitor access to Keychain and browser profile directories.
- Deploy endpoint security capable of detecting macOS infostealers.
- Restrict unauthorized software installation.
- Investigate unexpected browser profile cloning.
- Monitor headless browser execution.
- Keep macOS fully updated.
- Enable browser and endpoint threat protection.
- Rotate credentials if a compromised Mac was used for authenticated browser sessions.
- Revoke active browser sessions and authentication tokens following suspected compromise.
Threat Assessment
AmnesiaStealer represents a significant threat to macOS users because it combines social engineering, credential theft and browser-session hijacking.
The use of a fake GitHub download page makes the initial infection particularly convincing, while the ClickFix technique relies on the victim executing the malicious command themselves.
The stream_module capability is especially concerning because attackers can potentially operate authenticated browser sessions remotely, increasing the risk of account takeover and unauthorized transactions.
Indicators of Compromise
- github.aoitour[.]com — Fake GitHub phishing domain
- 4mn3s1a_2o26!xK — Embedded AmnesiaStealer configuration key
- stream_module — Browser session control component
- Amnesia Panel — Malware C2/backend
- /tmp — Malware staging location
Conclusion
The AmnesiaStealer campaign demonstrates the growing use of ClickFix-style attacks against macOS users.
Security teams should focus on detecting suspicious Terminal execution, malicious files launched from temporary directories, unauthorized Keychain access and unusual browser-session activity.
Users should never execute Terminal commands copied from unsolicited download pages, even when the website appears to be a trusted platform such as GitHub.