Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

AmnesiaStealer macOS infostealer distributed via ClickFix

Malware Activity
First reported
Last updated
Happening score
H score 16
2 unique sources, 2 articles

Summary

Hide ▲

AmnesiaStealer is a Rust-based macOS infostealer spread through a counterfeit GitHub "Download for macOS" page and ClickFix-style lure. It steals Keychain, browser data, Apple Notes, Telegram, and Safari content, and it can trigger hidden, operator-driven browser control over Chromium-family browsers through CDP. The malware also uses a three-stage dropper chain, can stage data for exfiltration, and includes macOS-specific techniques such as CVE-2020-9771 abuse on Catalina. Jamf tied the activity to a root LaunchDaemon impersonating Apple's crash reporting service and a configurable CLIPPER_ENABLED module for cryptocurrency clipboard hijacking.

Related Happenings

Fake Codex download campaign using Google Sites and ClickFix

Campaign
H score35 First: 24.08.2026 18:00 Last: 24.08.2026 18:00 Sources 1

About this happening: The fake Codex download campaign is using sponsored search results, Google Sites lures, and ClickFix instructions to push macOS users into running malware. The...

Open Happening

Proc-macro1 malicious crate payload

Malware Activity
H score29 First: 20.08.2026 20:53 Last: 20.08.2026 20:53 Sources 1

About this happening: A proc-macro1 typosquatted dependency executed a build-time payload during compilation, creating a credential-stealing risk for developers on Linux, Windows, and *...

Open Happening

MacSync Stealer rotating-domain exfiltration activity

Malware Activity
H score30 First: 19.08.2026 09:01 Last: 19.08.2026 09:01 Sources 1

About this happening: The MacSync Stealer operation has been tied to 30+ rotating domains and confirmed active data exfiltration, increasing the risk of credential theft on macOS endpoi...

Open Happening

CDP-Enable-BOF activates Chrome DevTools Protocol inside live Windows browsers for post-exploitation session access

Technical Analysis
H score23 First: 14.08.2026 14:07 Last: 14.08.2026 14:07 Sources 1

About this happening: CDP-Enable-BOF now enables Chrome DevTools Protocol access inside a live Google Chrome or Microsoft Edge process on Windows, raising the risk of cookie theft...

Open Happening

ClickFix AmnesiaStealer distribution campaign targeting mac users

Campaign
H score22 First: 14.08.2026 13:45 Last: 14.08.2026 13:45 Sources 1

How related: The page employs a ClickFix-style lure that instructs users to copy and paste a Base64-encoded command into the macOS Terminal app.

About this happening: A ClickFix campaign is distributing AmnesiaStealer to macOS users through a counterfeit GitHub "Download for macOS" page and a copy-and-paste command that launches...

Latest development: 16.08.2026 18:07

Jamf described AmnesiaStealer's stream_module and remote_stream commands, which copy a victim's Chromium profile into a hidden headless browser and open WebSocket and Chrome DevTools Protocol channels through webSocketDebuggerUrl. The operator can issue navigation and mouse commands, receive live screencasts, and export or import cookies to operate online portals inside the victim's authenticated sessions on Google Chrome, Microsoft Edge, Vivaldi, Arc, Opera, Brave, and Chromium.

Open Happening

Timeline

  1. 14.08.2026 13:45 2 articles · 13d ago

    Jamf identifies AmnesiaStealer spreading through ClickFix on macOS

    Initial Disclosure

    Jamf reported a new Rust macOS infostealer called AmnesiaStealer spreading through ClickFix social engineering against mac users. The lure uses a counterfeit GitHub download page and a self-deleting script to execute the malware, which harvests credentials, browser data and live sessions, avoids macOS permission prompts, and launches a hidden second stage that can take interactive control of Chromium-family browsers and steal cookies in plaintext.

    Show sources
    Open in new tab
  2. 13.08.2026 16:43 1 articles · 14d ago

    AmnesiaStealer adds a three-stage Rust payload and hidden browser control

    Technical Analysis Update

    The macOS Rust stealer uses a shell-script dropper to fetch and launch a password-protected ZIP archive, then unpacks a first-stage Mach-O binary with an embedded encrypted configuration and a second Rust infostealer that harvests Keychain, browser data, Apple Notes, and Telegram. It also triggers a hidden stream_module for interactive browser control, can enable CLIPPER_ENABLED clipboard hijacking, persists as a root LaunchDaemon impersonating Apple's crash reporting service, and steals Safari cookies through CVE-2020-9771 on Catalina.

    Show sources
    Open in new tab