AmnesiaStealer: The macOS Malware That Hijacks Victim Browser…

Jamf Threat Labs has documented AmnesiaStealer, a Rust-based macOS infostealer that clones the victim's Chromium profile, launches it headless, and hands operators live interactive control over authenticated sessions — a first for macOS.

Jamf Threat Labs has identified and analyzed AmnesiaStealer, a Rust-based macOS infostealer that does more than exfiltrate data: it clones the victim's Chromium profile, launches it in a headless browser, and grants the operator real-time interactive control over authenticated sessions. The discovery, published August 13, 2026, marks the first documentation of this technique on macOS.

The leap beyond traditional infostealers — Atomic Stealer, AMOS, and their derivatives — is stark. Those steal files, cookies, and credentials for reuse elsewhere. AmnesiaStealer lets the attacker drive the browser directly on the compromised machine, bypassing post-compromise defenses built on re-authentication and multi-factor authentication.

Key Takeaways

The stream_module, triggered by the remote_stream command, clones the local profile of seven Chromium-family browsers and launches it headless under operator control.
Dual WebSocket channels: one to the C2 relay for commands and screencast (~3 fps), the other to the local webSocketDebuggerUrl for Chrome DevTools Protocol (CDP) access.
Human input (keyboard, mouse, scroll, navigation, tabs) is translated into real-time CDP calls against the cloned browser, with fingerprinting APIs patched to mask automation.
A three-stage infection chain activates via ClickFix campaigns using a spoofed GitHub page that tricks the victim into pasting a Base64 command into Terminal.

From File Theft to Ghost Session: AmnesiaStealer's Operating Model

Distribution follows the now-established ClickFix pattern: a page mimicking GitHub asks the user to copy and paste a Base64-encoded command into Terminal. This launches the initial stage, a shell-script dropper that downloads and executes the main Rust-based infostealer.

The malware comprises three components. The first is a classic data collector: it steals credentials from 16 Chromium-based browsers, Apple Notes, Telegram, documents, crypto wallets, and the keychain. To unlock the Keychain it captures the macOS password via a native prompt that imitates the Installer window, validates it via dscl, and reuses it. The second stage is a crypto-asset clipper module, disabled in the analyzed sample according to Jamf.

The third stage — stream_module — is the innovation that defines the threat. Activated on operator command, it clones the victim's Chromium profile and mounts it in a headless instance. From that point the attacker no longer needs to exfiltrate the session for reuse: they drive it directly, with full UI visibility and pixel-perfect interaction capability.

The Dual-WebSocket Architecture: How Remote Control Works

The technical core is the simultaneous use of two WebSocket channels. The first maintains the connection to the command-and-control relay: it transmits the operator's screencast at roughly 3 frames per second and receives input instructions. The second channel connects to the webSocketDebuggerUrl exposed locally by the headless browser, providing native access to the Chrome DevTools Protocol.

CDP is Chromium's built-in debugging interface that enables tools like Chrome DevTools to inspect, modify, and pilot the browser runtime. AmnesiaStealer weaponizes it for the opposite purpose: operator actions are translated into real-time CDP calls, while injected scripts patch fingerprinting APIs — navigator.webdriver, window dimensions, user agent, WebGL — to prevent visited sites from detecting automation.

The result is a session indistinguishable from a real user's, yet entirely alien to the legitimate device. The operator navigates, fills forms, confirms transactions, and accesses cloud and banking consoles with the victim's already-active sessions.

"In effect the remote_stream command turns an infected host into a live, operator-driven browser running the victim's authenticated sessions, which is a materially different level of access from file collection." — Jamf Threat Labs

Persistence and the macOS 26 Problem

To maintain access, AmnesiaStealer installs a LaunchDaemon masquerading as Apple's crash-reporting service — a technique that hides the malicious process among system processes. The 15-byte XOR configuration key is encoded as a readable string: 4mn3s1a_2o26!xK, a detail Jamf recovered from static analysis of the sample with SHA-256 hash de5748aac4a4d4cb48cf050652679e6bc49eda33d9ffaa0d280b578122fab55a.

On macOS 26 the malware introduces a fallback mechanism: if it cannot retrieve the existing Chrome Safe Storage key, it replaces it with an attacker-supplied value. According to Jamf, this allows continued access to the browser's encrypted data, though the brief does not clarify whether the replacement takes retroactive effect on existing data or only on subsequent data.

The C2 administration panel is called "Amnesia Panel" and displays an error message in Russian: the sole element that might hint at the operators' linguistic origin, though Jamf offers no geographic or group attribution.

Why This Technique Changes Post-Compromise Defenses

AmnesiaStealer's significance lies in its break from the traditional infostealer operating model. Stealing cookies and credentials forces the attacker to re-enter the target service, often from a different endpoint, risking anomalous-login alerts, additional MFA challenges, or anti-fraud checks based on device fingerprinting.

With the CDP-controlled headless session, those checks become ineffective. The browser is the real one, the profile is the real one, the IP geolocation is the victim's. The only anomalous element — the absence of a physical display — is masked by the fingerprinting API patches. Defenses that assume compromise ends with data exfiltration must be recalibrated: here the compromise is continuous and interactive.

For enterprises managing access to cloud, banking, or corporate consoles from macOS, the implication is that the segmentation between compromised endpoint and authenticated session collapses. The malware does not break authentication: it wears it.

Historical Context: CDP Already Abused, But Not on macOS

Malware abuse of the Chrome DevTools Protocol is not new. Groups like Chaos ransomware and msaRAT have used CDP to route C2 traffic through legitimate browser instances, and Chaes malware has exploited similar protocols to steal data. However, all documented cases involve Windows. The combination of a cloned Chromium profile with interactive remote control via CDP on macOS has not previously appeared in technical literature.

AmnesiaStealer synthesizes known elements — ClickFix, Rust infostealer, CDP — into an architecture that multiplies their impact. As Jamf researchers note: "A working collector paired with a working browser-hijack stage, wrapped around a few dated bypasses, is what makes it worth tracking."

What to Do Now

Block ClickFix campaigns at the awareness level: the initial vector requires the victim's conscious action of pasting a Base64 command into Terminal; training on this specific pattern remains the most effective filter.
Monitor launchctl execution for jobs impersonating Apple system services, verifying the plist signature and executable path against trusted directories.
Detect launches of Chromium-family browsers in headless mode on macOS with a profile specified via --user-data-dir differing from standard locations, particularly under /tmp with 25-character alphanumeric random directory names.
Examine local WebSocket connections to typical Chrome DevTools Protocol ports (ws://127.0.0.1 with dynamic ports) originating from browser processes not associated with visible user sessions.

Frequently Asked Questions

Can AmnesiaStealer work on Safari or Firefox?

No. The stream_module explicitly supports seven Chromium-family browsers: Chrome, Brave, Edge, Arc, Opera, Vivaldi, and Chromium. Operation depends on the availability of the Chrome DevTools Protocol, present only in Chromium-based engines.

Does the malware require root privileges?

The persistence LaunchDaemon operates with root privileges, but initial infection requires no escalation: the Base64 command pasted by the victim into Terminal runs with the current user's privileges. The macOS password capture occurs via social engineering, not privilege-escalation exploit.

Is there a specific indicator of compromise?

Jamf has published the SHA-256 hash of the analyzed sample (de5748aac4a4d4cb48cf050652679e6bc49eda33d9ffaa0d280b578122fab55a) and the XOR configuration key. The dropper ZIP archive password is dulin. However, the dossier does not specify whether these indicators are static or vary across campaigns.

Information verified against cited sources and current as of publication.

Sources

Sources and references