Full Report
A new information-stealing malware called AmnesiaStealer, which targets macOS users via ClickFix attacks, includes a streaming module that allows the attacker to interactively control the victim's web browser. [...]
Analysis Summary
This summary provides a technical breakdown of AmnesiaStealer based on the provided report.
# Tool/Technique: AmnesiaStealer
## Overview
AmnesiaStealer is a sophisticated macOS-based information stealer that utilizes "ClickFix" social engineering tactics. Its primary purpose is to exfiltrate sensitive user data and provide attackers with interactive, remote control over a victim’s web browser sessions using a headless browser and the Chrome DevTools Protocol (CDP).
## Technical Details
- **Type:** Malware Family (Infostealer / Remote Access)
- **Platform:** macOS
- **Capabilities:** Credential theft, session hijacking, live browser streaming/control, cryptocurrency wallet exfiltration, and keychain harvesting.
- **First Seen:** Reported August 2026 (Per article date).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- **[T1566.002 - Phishing: Spearphishing Link]** (ClickFix via fake GitHub pages)
- **[TA0006 - Credential Access]**
- **[T1555.001 - Credentials from Password Stores: Keychain]**
- **[T1555.003 - Credentials from Password Stores: Credentials from Web Browsers]**
- **[TA0009 - Collection]**
- **[T1113 - Screen Capture]** (Screencast frames via stream_module)
- **[T1119 - Automated Information Discovery]** (Scanning for Apple Notes, Telegram, and docs)
- **[TA0011 - Command and Control]**
- **[T1071.001 - Application Layer Protocol: Web Protocols]** (WebSocket-based C2)
## Functionality
### Core Capabilities
- **Information Theft:** Targets 16 Chromium-based browsers to exfiltrate cookies, logins, history, and bookmarks.
- **Data Harvesting:** Searches for Apple Notes, Telegram sessions, local documents, and system metadata.
- **Keychain Access:** Prompts for the macOS password to unlock and exfiltrate the system keychain.
- **Crypto Targeting:** Enumerates browser extensions and IndexedDB data to identify and steal cryptocurrency wallet details.
### Advanced Features
- **Headless Browser Injection:** Clones the victim's Chromium profile and launches a headless instance with security flags disabled.
- **Interactive Remote Control:** Uses `stream_module` to provide the attacker with a 3fps live screencast and full mouse/keyboard input control over the victim's authenticated sessions.
- **Cookie Decryption Bypass:** On newer macOS versions, if the Chrome Safe Storage key cannot be recovered, it replaces it with an attacker-supplied value to ensure future data is decryptable by the operator.
## Indicators of Compromise
- **File Hashes:** [Specific hashes not provided in text; analysis points to Mach-O payloads].
- **File Names:** Typically contained within password-protected ZIP archives distributed via fake GitHub pages.
- **Network Indicators:**
- `hxxp[://]example-relay-domain[.]com` (Generic WebSocket relay for C2)
- WebSocket traffic on local ports used by `webSocketDebuggerUrl`.
- **Behavioral Indicators:**
- Terminal commands executed via "ClickFix" lures.
- Unexpected headless browser processes (Chrome/Edge/Brave) running with `--headless` and `--remote-debugging-port` flags.
## Associated Threat Actors
- Unknown/Unspecified (Shares TTPs and infrastructure templates with Atomic and MacSync infostealers).
## Detection Methods
- **Signature-based detection:** Monitoring for the specific Mach-O `stream_module` and associated shell scripts.
- **Behavioral detection:**
- Monitoring for unusual child processes of web browsers (e.g., headless flags).
- Detection of unauthorized WebSocket connections originating from browser processes to external IPs.
- Monitoring for terminal commands involving `curl | sh` patterns from browser-initiated prompts.
## Mitigation Strategies
- **User Education:** Advise users never to copy/paste and execute terminal commands provided by websites to "fix" errors.
- **System Hardening:** Use Mobile Device Management (MDM) to restrict the execution of unsigned or unnotarized binaries.
- **Browser Security:** Implement strict Content Security Policies (CSP) and monitor for unauthorized Chrome DevTools Protocol usage.
## Related Tools/Techniques
- **Atomic Stealer (AMOS):** Shares similar distribution templates.
- **MacSync:** Shares similar delivery infrastructure.
- **Chaes/Chaos Malware:** Previous instances of abusing the Chrome DevTools Protocol for C2.