AmnesiaStealer hijacks live macOS browser sessions to ride past logins

Jamf detailed a new macOS information stealer, AmnesiaStealer, spread through ClickFix lures that trick users into running a command from a fake download page. Beyond harvesting the login password, keychain, browser data, and cryptocurrency wallets, it includes a module that clones the victim's Chromium browser profile, including its logged-in state, into a hidden browser on the infected Mac and gives the attacker live remote control of it through the browser's debugging protocol. Because the session runs on the victim's own device with their real identifiers, this lets the attacker use authenticated accounts while sidestepping multi-factor authentication. Jamf calls it the first macOS malware to combine profile cloning with live remote browser control.

Check

Warn Mac users never to paste and run commands from a web page or fake download prompt, and treat unexpected browser sessions or new hidden browser processes as a compromise indicator.

Affected

macOS users tricked by ClickFix lures into running the loader; AmnesiaStealer steals credentials and wallets and clones logged-in browser sessions for live remote use, letting attackers bypass multi-factor authentication.

Fix

Block known ClickFix infrastructure, educate users against pasted-command prompts, keep macOS and security tooling current, and monitor for browsers launched in debugging mode and unexpected headless browser activity.