Full Report
Cybersecurity researchers have disclosed details of a new macOS-oriented, Rust-based information stealer called AmnesiaStealer that's capable of hijacking Chromium web browsers to steal session data. The multi-stage stealer is spread via a counterfeit GitHub download page titled "Download for macOS" and claims to be from a verified publisher. The page employs a ClickFix-style lure that
Analysis Summary
This summary provides a technical analysis of the **AmnesiaStealer** malware based on the provided research disclosure.
# Tool/Technique: AmnesiaStealer
## Overview
AmnesiaStealer is a sophisticated, multi-stage information stealer written in Rust and specifically designed to target macOS environments. It focuses on harvesting sensitive data from web browsers, cryptocurrency wallets, and messaging applications. Its most notable feature is a "remote_stream" module that grants attackers live, interactive control over the victim's browser.
## Technical Details
- **Type:** Malware family (Information Stealer)
- **Platform:** macOS
- **Capabilities:** Credential theft, session hijacking, host reconnaissance, clipboard hijacking (clipping), and remote browser control.
- **First Seen:** August 2026 (Reported)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link] (Counterfeit GitHub pages)
- **[TA0002 - Execution]**
- [T1059.002 - Command and Scripting Interpreter: AppleScript]
- [T1204.002 - User Execution: Malicious File]
- **[TA0003 - Persistence]**
- [T1543.001 - Create or Modify System Process: Launch Agent/Daemon]
- **[TA0004 - Privilege Escalation]**
- [T1548.003 - Abuse Privilege Escalation Mechanism: Sudo and Sudo Caching]
- **[TA0006 - Credential Access]**
- [T1555.003 - Credentials from Web Browsers]
- [T1539 - Steal Web Session Cookie]
- [T1552.001 - Unsecured Credentials: Credentials In Files]
- **[TA0007 - Discovery]**
- [T1082 - System Information Discovery]
- **[TA0009 - Collection]**
- [T1115 - Clipboard Data]
- [T1560 - Archive Collected Data]
## Functionality
### Core Capabilities
- **Browser Hijacking:** Targets 16 Chromium-based browsers (Chrome, Brave, Arc, Edge) to steal cookies, login data, master keys, and preferences.
- **System Credential Theft:** Uses a native macOS prompt to trick users into entering their system password, which is then validated via `dscl` and used to unlock the Keychain.
- **Data Harvesting:** Automatically searches for and exfiltrates files from Desktop, Documents, and Downloads with specific extensions (.txt, .wallet, .key, .csv, etc.).
- **Keychain Access:** Decrypts Safari cookies and extracts "Safe Storage" passwords to recover browser master keys.
### Advanced Features
- **Remote Stream Module:** A second-stage Rust binary that allows operators to gain hidden, interactive control of the victim's web browser session.
- **Clipper Module:** An optional module that monitors the clipboard for cryptocurrency addresses (BTC, ETH, SOL, etc.) and replaces them with attacker-controlled addresses.
- **TCC Bypass:** Leverages CVE-2020-9771 to target older macOS versions (Catalina) for disk access.
## Indicators of Compromise
- **File Names:** `tempAppleScript.scpt`, `~/.pwd`, `pwd` (in staging directory).
- **Network Indicators:** `debug[.]allllowef[.]space/send/` (Defanged C2 endpoint).
- **Behavioral Indicators:**
- Presence of a LaunchDaemon masquerading as Apple’s crash reporting service.
- Creation of a 25-character random alphanumeric directory under `/tmp`.
- Repeated system password prompts if the initial entry is "incorrect" (validation via `dscl`).
- System volume being muted via AppleScript during execution.
## Associated Threat Actors
- While specific threat groups are not named, the malware utilizes "ClickFix" lures, a technique frequently associated with broader cybercriminal campaigns targeting macOS users globally.
## Detection Methods
- **Behavioral Detection:** Monitoring for the execution of `dscl` or `security unlock-keychain` from unsigned or suspicious binaries. Watch for AppleScripts that mute system audio followed by mass file access.
- **Persistence Monitoring:** Auditing `/Library/LaunchDaemons` for new or suspicious entries mimicking legitimate Apple services.
- **File Monitoring:** Detecting the creation of the `.pwd` hidden file in the user's home directory.
## Mitigation Strategies
- **User Education:** Advise users against copying and pasting Terminal commands from GitHub or other web pages (ClickFix protection).
- **Hardening:** Implement MDM profiles that restrict the execution of unsigned scripts and binaries.
- **Endpoint Security:** Use macOS-specific security tools (like Jamf or Apple’s built-in XProtect) that can identify known signatures of Rust-based stealers.
- **Password Hygiene:** Avoid reusing system passwords and enable hardware-based MFA for browser-stored accounts.
## Related Tools/Techniques
- **ClickLock Stealer:** A similar macOS malware family using the same social engineering lures.
- **ClickFix:** The social engineering technique involving fake "Fix It" instructions to run Terminal commands.