AmnesiaStealer macOS Malware Hijacks Browser Sessions via Fake GitHub Lure

A newly identified macOS infostealer called AmnesiaStealer is spreading via a convincing fake GitHub download page, tricking Mac users into pasting a malicious Terminal command that silently installs malware and can later grant attackers live, hidden control of the victim’s browser session.

Security researchers at Jamf Threat Labs discovered the campaign after spotting a counterfeit site at github.aoitour[.]com that near-perfectly copies GitHub’s dark theme, Octocat logo, and “Verified Publisher” badge.

Instead of offering a real download, the page displays a “Terminal installation” box with a one-click copy button and step-by-step instructions telling visitors to open Terminal, paste the command, press Return, and enter their device password.

This social-engineering technique, known as ClickFix, has also been used to spread other Mac malware families like Atomic (AMOS) and MacSync, showing that criminal groups are reusing the same deceptive template across campaigns.

Once a victim pastes the command, a hidden shell script quietly downloads a password-protected ZIP archive, extracts a disguised binary into the /tmp folder, strips Apple’s quarantine flag, and launches the payload before deleting its own tracks.

This is followed by a Rust-based infostealer that profiles the machine, displays a fake native “Installer” password prompt to capture the login credential, and uses it to unlock the keychain, Apple Notes, Telegram sessions, browser data, and documents.

The malware is named after the “Amnesia Panel” backend it communicates with, and its embedded configuration is unlocked with the key 4mn3s1a_2o26!xK.

The most concerning capability arrives in a third component called stream_module. Fetched only on command from the attacker’s panel, this stage clones the victim’s browser profile, launches it in headless mode, and connects to the Chrome DevTools Protocol.

This gives the attacker a live screencast of the session along with full mouse, keyboard, and navigation control, effectively letting them operate the victim’s logged-in browser sessions, email, banking, and social media without the victim ever seeing anything change on their own screen, reads the Jamf Threat Labs report shared with Cyber Security News.

Interestingly, several of the malware’s attempts to sidestep Apple’s privacy protections rely on techniques Apple patched years ago, including a 2020 APFS snapshot bypass.

On modern macOS versions like macOS 26, these attempts largely fail, and the malware’s own debug logs record the failures. However, its core credential and browser-session theft still works effectively, especially against advanced users who may already have granted broader system permissions.

AmnesiaStealer illustrates a growing trend where attackers combine believable phishing pages with staged, remotely triggered payloads rather than a single static malware file.

Because the initial infection relies entirely on tricking a user into running a Terminal command, the most effective defense is simple: never paste unknown commands into Terminal, especially ones sourced from unsolicited download prompts.

Keeping macOS updated, enabling browser and endpoint threat protection, and treating any password prompt tied to a “software installer” with suspicion are essential precautions as this campaign continues to evolve.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.