New AmnesiaStealer macOS malware hijacks browser sessions via remote control

A new information-stealing malware called AmnesiaStealer, which targets macOS users via ClickFix attacks, includes a streaming module that allows the attacker to interactively control the victim's web browser.

A notable capability is copying the victim's Chromium profile, including its authentication state, and loading it into a hidden, headless browser on the infected system.

This allows the hacker to access victims' authenticated sessions while preserving the identifiers associated with the browser, host, and network.

AmnesiaStealer can collect data in 16 Chromium-based web browsers as well as other sensitive information, such as passwords, cryptocurrency wallets, Apple Notes and documents, and keychain data.

The malware is currently distributed through ClickFix campaigns that use a fake GitHub download page to drop a password-protected ZIP archive.