A new information-stealing malware called AmnesiaStealer, which targets macOS users via ClickFix attacks, includes a streaming module that allows the attacker to interactively control the victim’s web browser.
A notable capability is copying the victim’s Chromium profile, including its authentication state, and loading it into a hidden, headless browser on the infected system. This allows the attacker to access victims’ authenticated sessions while preserving the identifiers associated with the browser, host, and network.
AmnesiaStealer can collect data from 16 Chromium-based web browsers as well as other sensitive information, such as passwords, cryptocurrency wallets, Apple Notes and documents, and keychain data.
Distribution via ClickFix
The malware is currently distributed through ClickFix campaigns that use a fake GitHub download page to drop a password-protected ZIP archive.
Fake GitHub page pushing a ClickFix lure — Source: Jamf
Researchers at Jamf, an Apple device management and security company, analyzed AmnesiaStealer’s distribution and found that it used the same template previously used to spread the Atomic and MacSync infostealers.
The ClickFix command executes a shell-script loader that downloads and launches the password-protected archive containing the AmnesiaStealer Mach-O payload.
The malware captures the victim’s macOS password and uses it to collect keychain data, as well as browser profiles, Apple Notes, Telegram sessions, documents, system information, and cryptocurrency wallet data.
Stealing the admin password — Source: Jamf
Remote Browser Control via stream_module
The researchers highlight that the malware features a component called stream_module, retrieved using the remote_stream command, which gives the malicious operator remote control over authenticated sessions deployed from a headless browser instance.
According to Jamf, AmnesiaStealer’s stream_module can duplicate user profiles in seven Chromium-based browsers, including Google Chrome, Microsoft Edge, Vivaldi, Arc, Opera, Brave, and Chromium, because they share the same DevTools Protocol, launch flags, and cookie encryption.
The module launches the legitimate browser executable in headless mode with command-line switches that weaken browser defenses, duplicates the victim’s profile, and specifies its location for storing the profile data.
The malware then establishes a WebSocket channel that connects to the operator’s relay and sends a JSON registration message containing the browser name and build. The operator can then send commands over this channel, such as navigation and mouse clicks, while the malware returns status and tab information as JSON and transmits screencast frames as binary WebSocket messages.
A second WebSocket channel connects to the local headless Chromium instance through the browser’s webSocketDebuggerUrl, providing access to the Chrome DevTools Protocol (CDP). This allows the attacker to navigate websites with mouse and keyboard control, export or import cookies, and operate online portals using the victim’s existing authenticated sessions.
“The operator receives a live screencast of the session at around 3fps and can drive it with a full input set: keyboard, mouse, scroll, navigation and tab management,” Jamf explains.
“In effect the
remote_streamcommand turns an infected host into a live, operator-driven browser running the victim’s authenticated sessions, which is a materially different level of access from file collection.”
From the live screencast — Source: Jamf
Data Theft Capabilities
AmnesiaStealer can exfiltrate cookies, saved logins, browsing history, bookmarks, extensions, local state, and other profile data from the 16 Chromium-based browsers it targets. It also steals cryptocurrency wallet details by enumerating extensions and IndexedDB data.
Jamf notes that the malware contains a fallback mechanism when it runs on macOS 26 and cannot recover the existing Chrome Safe Storage key — it replaces the key with an attacker-supplied value, making previously stored cookies and passwords permanently unreadable while allowing the attacker to decrypt data collected afterward.
CDP Abuse and Broader Context
The Chrome DevTools Protocol (CDP) has been abused by malware in the past, including by Chaos ransomware to hide command-and-control communications, and by Chaes malware to expose browser functions that enable data theft.
However, AmnesiaStealer appears to be the first documented macOS malware to combine a cloned Chromium profile with CDP-based live remote control, allowing attackers to interact with authenticated sessions through a hidden browser running on the infected machine. Users are advised never to execute terminal commands found online that they do not fully understand.
