Jamf found a Rust-based macOS stealer, AmnesiaStealer, delivered in recent ClickFix attacks through a fake GitHub installer page. The malware targets passwords, keychains, Chromium-based browser data, and Safari cookies, then can switch into a browser-control module on demand.
That second module uses the Chrome DevTools Protocol, the same browser-inspection interface developers use, to launch a hidden copy of the victim’s browser and drive it in real time. In plain terms, the attacker is not just reusing stolen cookies later; they can act inside the already logged-in session while it is still live, which turns endpoint theft into account abuse.
The reach is broader than macOS itself: any environment that leans on browser-based SSO and open sessions can inherit the same risk if a user is lured into the paste-and-run flow. Static password resets and cookie changes may come after the fact, but they do not describe what may already have happened inside the session.