“The operator receives a live screencast of the session at around 3fps and can drive it with a full input set: keyboard, mouse, scroll, navigation and tab management,” Jamf explains.
What AmnesiaStealer is and how it arrives via ClickFix
Researchers at Jamf, an Apple device management and security company, describe AmnesiaStealer as a new information-stealing malware that targets macOS users through ClickFix campaigns. The campaigns present a fake GitHub download page and drop a password-protected ZIP archive. A ClickFix command executes a shell-script loader that downloads and launches that archive, which contains an AmnesiaStealer Mach-O payload.
AmnesiaStealer’s stream_module: live control of authenticated browser sessions
Jamf’s analysis highlights a component called stream_module, retrieved using the remote_stream command, which gives the attacker remote control over authenticated sessions deployed from a headless browser instance on the infected host. The module launches a legitimate Chromium executable in headless mode with command-line switches that weaken browser defenses, duplicates the victim’s profile, and specifies where profile data will be stored.
Once the headless instance is running, AmnesiaStealer establishes a WebSocket channel to the operator’s relay and sends a JSON registration message containing the browser name and build. The operator can then send commands—navigation, mouse clicks, tab management—over that channel while the malware returns status and tab information as JSON and streams screencast frames as binary WebSocket messages.
A second WebSocket channel connects locally to the headless Chromium instance using the browser’s webSocketDebuggerUrl, providing access to the Chrome DevTools Protocol (CDP). Via CDP the attacker can navigate with keyboard and mouse control, export or import cookies, and operate online portals using the victim’s existing authenticated sessions. Jamf summarizes the effect: the infected host becomes “a live, operator-driven browser running the victim's authenticated sessions,” a level of access distinct from passive file collection.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleWhich browsers and data are targeted
AmnesiaStealer can collect data from 16 Chromium-based browsers and specifically duplicates user profiles in seven named Chromium derivatives—Google Chrome, Microsoft Edge, Vivaldi, Arc, Opera, Brave, and Chromium—because they share the same DevTools Protocol, launch flags, and cookie encryption. The malware exfiltrates cookies, saved logins, browsing history, bookmarks, extensions, local state, and other profile data. It also targets cryptocurrency wallet details, enumerating extensions and IndexedDB data to identify wallets, and collects passwords, Apple Notes, Telegram sessions, documents, system information, and keychain data.
Technical caveat: macOS 26 fallback for Chrome Safe Storage
Jamf notes a fallback mechanism in AmnesiaStealer when it runs on macOS 26: if the malware cannot recover the existing Chrome Safe Storage key, it replaces that key with an attacker-supplied value. That action renders previously stored cookies and passwords permanently unreadable to local processes while allowing the attacker to decrypt data later under the attacker-controlled key.
Distribution context, past templates, and related CDP abuse
Jamf found that the ClickFix lure used a distribution template the researchers previously observed spreading the Atomic and MacSync infostealers. The AmnesiaStealer campaign follows the same basic delivery pattern: fake GitHub page, password-protected ZIP, shell-script loader, and native Mach-O payload. Jamf also points out that the Chrome DevTools Protocol has been abused by malware before—citing Chaos ransomware and Chaes malware as prior examples—making AmnesiaStealer notable as the first documented macOS threat to combine a cloned Chromium profile with CDP-based live remote control.
What this means for technologists, enterprises, and end users
- Technologists and security teams: The stream_module’s use of a headless, legitimate browser executable and CDP means post-exploitation monitoring must look for abnormal headless browser processes, unexpected WebSocket connections, and profile duplication activity. The presence of a password-protected ZIP and a shell-script loader in ClickFix-style campaigns suggests forensic teams should preserve the original archive and loader script when investigating.
- Enterprises and procurement leaders: Because AmnesiaStealer preserves identifiers associated with browser, host, and network while allowing live operator interaction with authenticated sessions, defenders should assume credential theft alone underestimates attacker capabilities. Jamf’s coverage emphasizes that “overall prevention scores can hide what happens after initial access,” and the Blue Report 2026 referenced in the analysis shows prevention effectiveness drops sharply once attackers use valid credentials.
- End users and administrators: Jamf reiterates a practical step—never execute terminal commands found online that you do not fully understand. The ClickFix lure depends on a user running a script that launches the payload; avoiding that action stops this campaign at the first step.
AmnesiaStealer changes the calculus: rather than merely exfiltrating cookies and stored credentials, it can replay and operate sessions interactively from the victim’s device. That capability—streaming at roughly 3 frames per second while accepting full input—elevates the risk from data theft to real-time abuse of accounts and services authenticated on the compromised machine.
Read the original Jamf-based reporting at: https://www.bleepingcomputer.com/news/security/new-amnesiastealer-macos-malware-hijacks-browser-sessions-via-remote-control/
