Jamf found a Rust-based macOS stealer, AmnesiaStealer, delivered in recent ClickFix attacks through a fake GitHub installer page. The malware targets passwords, keychains, Chromium-based browser data, and Safari cookies, then can switch into a browser-control module on demand.
That second module uses the Chrome DevTools Protocol, the same browser-inspection interface developers use, to launch a hidden copy of the victim’s browser and drive it in real time. In plain terms, the attacker is not just reusing stolen cookies later; they can act inside the already logged-in session while it is still live, which turns endpoint theft into account abuse.
The reach is broader than macOS itself: any environment that leans on browser-based SSO and open sessions can inherit the same risk if a user is lured into the paste-and-run flow. Static password resets and cookie changes may come after the fact, but they do not describe what may already have happened inside the session.
New AmnesiaStealer macOS malware hijacks browser sessions via remote control
A new information-stealing malware called AmnesiaStealer, which targets macOS users via ClickFix attacks, includes a streaming module that allows the attacker to interactively control the victim's web browser.