Security researchers at Jamf have identified a new macOS information stealer called AmnesiaStealer that goes beyond typical credential theft by giving attackers live, interactive control over a victim’s authenticated browser sessions.
The malware is distributed through ClickFix campaigns using a fake GitHub download page that tricks victims into running a shell-script loader. That loader downloads and executes a password-protected ZIP archive containing the AmnesiaStealer Mach-O payload. Jamf notes the distribution template is the same one previously used to spread the Atomic and MacSync infostealers.
Password Theft and Broad Data Collection
Once running, AmnesiaStealer captures the victim’s macOS admin password and uses it to unlock keychain data. It also collects browser profiles, Apple Notes, Telegram sessions, documents, system information, and cryptocurrency wallet data, identifying wallets by enumerating browser extensions and IndexedDB entries.
Remote-Controlled Browser Sessions
The malware’s most notable feature is a component called stream_module, triggered via a remote_stream command. This module duplicates the victim’s Chromium profile, including its authentication state, and loads it into a hidden, headless browser instance on the infected machine.
According to Jamf, stream_module works across seven Chromium-based browsers, including Chrome, Edge, Vivaldi, Arc, Opera, Brave, and Chromium, since they share the same DevTools Protocol, launch flags, and cookie encryption. After duplicating the profile, the malware opens two WebSocket channels: one connecting to the attacker’s relay server, and another linking to the local headless browser through its webSocketDebuggerUrl, granting access to the Chrome DevTools Protocol (CDP).
This setup lets the operator view a live screencast of the session at roughly 3fps while issuing keyboard, mouse, scroll, navigation, and tab commands, effectively turning the infected host into a live, attacker-driven browser using the victim’s own logged-in sessions.
Jamf also found that on macOS 26, AmnesiaStealer includes a fallback that replaces the Chrome Safe Storage key with an attacker-supplied value when it cannot recover the original, permanently locking existing cookies and passwords for the user while allowing the attacker to decrypt future data.
AmnesiaStealer can exfiltrate cookies, saved logins, browsing history, bookmarks, extensions, and local state from 16 Chromium-based browsers. While CDP abuse has been seen before in malware such as Chaos ransomware and Chaes, Jamf says AmnesiaStealer is the first documented macOS malware to combine a cloned browser profile with CDP-based live remote control of authenticated sessions.
Security teams should continue advising users never to run terminal commands copied from unfamiliar websites or ClickFix-style prompts.