Full research report

New AmnesiaStealer macOS malware hijacks browser sessions via remote control

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

AmnesiaStealer represents a qualitative escalation in macOS infostealer capability: where earlier families such as Atomic Stealer and MacSync limited themselves to file exfiltration, AmnesiaStealer adds a live, operator-driven browser control stage that preserves the victim's network and device fingerprint, making session hijacking significantly harder to detect at the application layer. The malware is Rust-based, builder-configured, and version-aware—branching its attack logic for macOS 26's strengthened TCC protections, with a destructive fallback that permanently overwrites browser Safe Storage keys when normal credential recovery fails. Infrastructure indicators (Russian-language panel, shared ClickFix lure templates, builder-generated per-campaign configs) point to an organised, ongoing operation rather than a proof-of-concept release, though no specific threat actor has been named. The CDP-based streaming module, documented here for the first time on macOS, has clear precedent on Windows (Chaes, Chaos ransomware) and signals a technique that is likely to be replicated or licensed by other macOS stealer families. Defenders should treat ClickFix-style macOS lures as a high-priority detection category and audit for headless browser process launches on managed endpoints.

What happened

Jamf Threat Labs published a technical report on 13 August 2026 documenting AmnesiaStealer, a Rust-based three-stage macOS infostealer actively distributed through ClickFix social-engineering campaigns using counterfeit GitHub download pages. The malware's distinguishing feature is a second-stage streaming module that clones the victim's Chromium profile into a hidden headless browser and gives the operator real-time interactive control over authenticated web sessions via Chrome DevTools Protocol (CDP). Jamf researcher Thijs Xhaflaire confirmed the campaign reuses lure infrastructure previously associated with Atomic Stealer and MacSync.

Affected scope

macOS systems across all user-facing sectors; 16 Chromium-family browsers targeted for credential and cookie theft (Chrome, Brave, Arc, Microsoft Edge, Opera, Vivaldi, Chromium and others); Safari targeted via a legacy APFS snapshot technique; Apple Keychain, Apple Notes, Telegram, and cryptocurrency wallet extensions also in scope. macOS 26 systems face an additional destructive impact: if the malware cannot recover the browser Safe Storage key it overwrites it, permanently destroying previously stored encrypted credentials.

Technical assessment

The infection chain begins with a ClickFix lure prompting the victim to paste a Base64-encoded shell command into Terminal. The shell script fetches a password-protected ZIP archive, strips macOS quarantine metadata, applies ad-hoc code signing, and executes the Rust payload. The infostealer presents a native-looking AppKit password prompt, validates the captured credential locally via dscl, then uses it to unlock the login and data-protection keychains. For Safari, it attempts two TCC bypasses: an APFS snapshot mount (CVE-2020-9771) and direct SQLite injection into TCC.db, both of which fail on hardened macOS 26. The stream_module—retrieved on operator command—launches a legitimate browser executable in headless mode with a cloned victim profile, establishes a WebSocket channel to the operator relay, and opens a second WebSocket to the local CDP debugger endpoint. This dual-channel architecture provides the operator with a live screencast at approximately 3 fps and full keyboard/mouse input capability over the victim's authenticated sessions, while stealth script injection suppresses browser automation fingerprinting. Persistence is achieved via a root LaunchDaemon masquerading as Apple's crash-reporting service.

Recommended defensive actions

  1. Patch to the latest macOS release to limit the effectiveness of legacy TCC bypasses including the APFS snapshot mount technique exploited via CVE-2020-9771
  2. Block or alert on outbound WebSocket connections to unknown external hosts, particularly to domains matching the pattern *.allllowef[.]space and similar newly registered apex domains
  3. Hunt for LaunchDaemon plists at /Library/LaunchDaemons/ with names resembling com.apple.ReportCrash.agent with random numeric suffixes
  4. Monitor endpoint telemetry for browsers launched with --headless, --remote-debugging-port, or --user-data-dir flags by processes other than the user's own shell
  5. Audit macOS endpoints for the shell command pattern associated with ClickFix delivery: base64-encoded commands pasted into Terminal followed by prompt for macOS login password
  6. Scan for the confirmed SHA-256 indicators: de5748aac4a4d4cb48cf050652679e6bc49eda33d9ffaa0d280b578122fab55a (Stage 1 Rust payload) and e853748ca8f9a5a9168263617409a9039ab09f4ffc7d860374c1e3b0b67b31a5 (stream_module)
  7. Rotate browser-stored credentials and revoke active web sessions for any macOS user who may have followed a ClickFix-style GitHub download prompt

Uncertainties and evidence gaps

  • No confirmed threat actor identity beyond Russian-language operator panel; attribution to a specific group or individual remains unestablished
  • Victim count and campaign reach have not been disclosed; Jamf's report is based on sample analysis rather than telemetry from active infections at scale
  • The cryptocurrency clipper module was present in the analysed build but disabled; it is unknown whether operator-controlled builds activate it
  • It is unconfirmed whether any macOS Keychain contents or browser credentials have been auctioned or used in downstream fraud following exfiltration

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessUser-initiated: victim must paste an attacker-supplied Terminal command and provide their macOS login password in response to a spoofed installer prompt
ComponentmacOS Keychain, Chromium browser profile directories, TCC (Transparency, Consent and Control) privacy framework, Safari cookie store, LaunchDaemon persistence layer
MechanismSocial engineering bypasses OS-level install controls; the malware uses the captured login password to access the keychain directly. A legacy APFS snapshot mount (CVE-2020-9771) is attempted for Safari cookies. CDP is used to drive a headless browser instance loaded with the victim's cloned authenticated profile, enabling session-level access without re-authenticating
ImpactFull exfiltration of browser credentials, cookies, Apple Keychain secrets, cryptocurrency wallet data, and documents; persistent root-level LaunchDaemon survives reboots; on macOS 26, Safe Storage key overwrite permanently destroys previously encrypted browser credentials; operator gains live authenticated access to any web portal open in the victim's browser
DetectionUnexpected browser processes launched with --headless or --remote-debugging-port flags; outbound WebSocket connections to unfamiliar domains; new LaunchDaemon plists resembling Apple crash-reporting services; Terminal spawning curl or sh with base64-decoded payloads; network traffic to /api/bot/join or /send/ endpoints
MitigationKeep macOS fully patched (limits CVE-2020-9771 and TCC.db bypass); remove the identified LaunchDaemon plist and associated payload from /tmp/; rotate all credentials and revoke active sessions; block confirmed C2 domain debug.allllowef[.]space at DNS and network perimeter
Exploitation status

Active distribution confirmed via ongoing ClickFix campaigns; no independent reporting of large-scale victim impact beyond Jamf's discovery. CVE-2020-9771 (APFS snapshot mount, 2020) is reused as a component technique for Safari cookie theft, not a novel exploit.

Research process

The investigation began with BleepingComputer's 16 August 2026 report citing Jamf research, which was fetched and confirmed to be substantive. The Jamf primary blog post was retrieved and yielded highly detailed technical findings including SHA-256 hashes, C2 endpoints, hardcoded keys, and stage-by-stage code analysis. Three independent security outlets—SecurityWeek, The Hacker News, and SecurityAffairs—were fetched and confirmed corroborating coverage, validating the core technical claims. A targeted search for threat actor attribution found consistent evidence of Russian-language operator infrastructure but no named actor or group. The resulting assessment is high-confidence: the malware is real, actively distributed, technically novel in its CDP-based live session hijacking, and sourced from an unidentified but apparently established operation.

  1. Does the BleepingComputer article substantiate the AmnesiaStealer claims and link to a primary Jamf source?
    Fetched the BleepingComputer article directly
    bleepingcomputer.com ↗

    Article confirmed: Jamf is the primary researcher; no CVEs stated; key claims about ClickFix distribution, CDP stream_module, 16 Chromium browsers, and macOS 26 Safe Storage overwrite are documented

    why Established the event as real reporting with a named primary source; flagged Jamf blog as the essential next URL to fetch

  2. Which security outlets have independently covered AmnesiaStealer and what URLs are confirmed live?
    Searched for 'AmnesiaStealer macOS malware Jamf 2026' and 'AmnesiaStealer ClickFix macOS infostealer browser hijack 2026'

    Confirmed live coverage from SecurityWeek, The Hacker News, SecurityAffairs, SC Media, CyberSecurityNews, and MacTech; Jamf blog URL confirmed as https://www.jamf.com/blog/amnesia-stealer-macos-infostealer-clickfix/

    why Identified independent corroborating domains and prioritised which URLs to fetch for verification

  3. What are the full technical details, IoCs, and researcher attribution in the Jamf primary source?
    Fetched the Jamf Threat Labs blog post
    jamf.com ↗

    Confirmed researcher Thijs Xhaflaire; SHA-256 hashes for both stages; C2 host debug.allllowef[.]space; hardcoded keys; three-stage architecture; CVE-2020-9771 reuse; root LaunchDaemon persistence; Russian-language Amnesia Panel; publication date 13 August 2026

    why Jamf is the sole primary source; all key technical claims are now verified against the original research

  4. Does SecurityWeek independently confirm the CVE-2020-9771 reuse and Safe Storage overwrite impact?
    Fetched the SecurityWeek article
    securityweek.com ↗

    Confirmed: SecurityWeek independently notes CVE-2020-9771 use and documents Safe Storage key overwrite as a destructive side-effect on macOS 26

    why Second independent domain confirms the most operationally significant impact (permanent credential destruction) and the legacy CVE reuse

  5. Does The Hacker News corroborate the three-stage chain and CDP-based remote control mechanism?
    Fetched The Hacker News article
    thehackernews.com ↗

    Confirmed: three-stage chain, clipboard hijacker present but disabled, Russian-language C2 panel, stealth script suppressing automation fingerprinting; consistent with Jamf and SecurityWeek

    why Third independent domain; no contradictions found, increasing confidence in the technical assessment

  6. Is there any confirmed threat actor attribution beyond Russian-language panel indicators?
    Searched for 'AmnesiaStealer threat actor attribution Amnesia Panel Russian macOS stealer 2026' and fetched SecurityAffairs
    securityaffairs.com ↗

    No named actor or group attributed; SecurityAffairs describes shared lure infrastructure with Atomic Stealer and MacSync, suggesting an established operation; Russian language in the panel is the only attributive signal

    why Attribution remains unresolved; this is recorded as a material uncertainty rather than inferred as confirmed

Named in this story
ActorsUnknown; Russian-speaking operator inferred from Cyrillic error messages in the Amnesia Panel C2 interface
MalwareAmnesiaStealerAtomic Stealer (AMOS)MacSyncCrashStealer
TargetsmacOS users globallyChromium-based browser userscryptocurrency holdersindividuals with Apple Keychain credentials
Related CVEs CVE-2020-9771

Research coverage

All 68 registered source leaves were evaluated for this run: 60 completed, 0 were unavailable, 1 failed and 7 were disabled. For this story, 1 registered sources supplied useful evidence (1 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 59 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
BleepingComputernews ok4 records Primary evidence2 matched items Published the source report used to frame and date the event. Supplied independent analysis opened and verified during focused research.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CISA KEVkev ok1665 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5324 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok684 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1009 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch failed0 records Failed The current collection attempt failed; this source cannot support the report.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok7729 records Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok12 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Mastodon #infosecresearch ok18 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok13 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok18 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1590 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
The Hacker Newsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 4 opened outside the registered collection
References & evidence
Vendor & gov advisories1
AmnesiaStealer: macOS Infostealer That Hijacks Browsers — Jamf Threat Labs jamf.com ↗

Primary technical analysis by Jamf researcher Thijs Xhaflaire; includes SHA-256 hashes, C2 endpoints, and stage-by-stage code review

Analysis & research4
New AmnesiaStealer macOS malware hijacks browser sessions via remote control — BleepingComputer bleepingcomputer.com ↗

First major press write-up, 16 August 2026; draws directly on Jamf findings

AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions — SecurityWeek securityweek.com ↗

Independent editorial summarising CVE-2020-9771 reuse and Safe Storage overwrite impact

AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS — The Hacker News thehackernews.com ↗

Corroborating coverage confirming three-stage chain, clipboard hijacker module, and C2 panel details

AmnesiaStealer Gives Attackers Live Control of Victims' macOS Browsers — SecurityAffairs securityaffairs.com ↗

Adds context on shared lure infrastructure with Atomic Stealer and MacSync campaigns