macOS malware allows attackers to remotely control authenticated browser sessions
Researchers have found AmnesiaStealer, a macOS malware that hijacks browser sessions and steals credentials through remote control of a hidden browser running victim authentication.
Security researchers at Jamf have identified AmnesiaStealer, a macOS malware distributed through ClickFix attacks that steals browser session data and credentials. According to BleepingComputer, the malware can copy Chromium browser profiles from seven browsers including Chrome, Edge, and Brave, then load them into a hidden browser controlled remotely by attackers.
A distinctive capability called stream_module allows attackers to remotely control authenticated browser sessions at approximately 3 frames per second, using keyboard, mouse, and navigation commands. The malware also collects passwords, cryptocurrency wallet details, Apple Notes, Telegram sessions, and keychain data. It arrives through fake GitHub download pages that distribute password-protected archives, and researchers note this is the first documented macOS malware combining cloned profiles with remote browser control via Chrome DevTools Protocol.