Amnesia-Stealer: New macOS Information-Stealing Malware with Browser-Session Hijacking Capabilities

Advisory ID: NCC-CSIRT-2026-039

Summary: 

JAMF Threat Labs reported AmnesiaStealer, a multi-stage Rust-based macOS information stealer distributed through counterfeit GitHub download pages using ClickFix-style social engineering. Victims are instructed to copy and execute a command in macOS Terminal. Reported capabilities include collection of credentials, Keychain and browser data, Apple Notes, Telegram-related data and documents. A separate module can clone supported Chromium browser profiles and provide remote browser control, creating a risk of misuse of authenticated sessions. NCC-CSIRT has not established that Nigerian organizations have been affected.

Damage: High

Probability: Medium

Product (s): 

  • Apple macOS devices
  • Chromium-based browsers
  • Chromium Browsers’ profiles and stored credentials
  • macOS Keychain and locally stored data

Version (s): All macOS and Chromium browser versions

Platform (s): 

  • Apple macOS devices
  • macOS endpoints
  • Enterprise workstations
  • Telecommunications operator offices and support environments
  • Government and business systems using macOS

Description: 

The reported infection chain begins with a counterfeit GitHub download page that prompts a user to paste and execute a command in Terminal. The command initiates delivery and execution of the malicious payload. The malware then collects selected sensitive information from the compromised Mac. Research also describes a separate browser-control component that can operate a cloned Chromium browser profile remotely. This capability may enable misuse of existing authenticated sessions; it does not mean every account protected by multifactor authentication will necessarily be compromised. The attack relies on user-assisted execution rather than confirmed drive-by exploit in the chain described. No Nigeria-specific targeting or victimization is established by the cited public reporting.

Consequences: 

Potential consequences associated with foreign information manipulation and disinformation campaigns may include:

  • Theft of credentials and sensitive local data
  • Unauthorized access to email, cloud and other online accounts
  • Misuse of authenticated browser sessions
  • Exposure of confidential organizational information
  • Financial fraud and impersonation
  • Potential further compromise through stolen credentials or sessions

Threat Types: 

  • Poten
  • Information Stealer
  • Social Engineering (ClickFix)
  • Credential and Session Theft
  • Browser-Session Hijacking
  • Data Exfiltration

Solutions/Mitigations:  

NCC-CSIRT recommends the following actions:

  • Do not paste or execute commands from unfamiliar websites, counterfeit download pages or unsolicited instructions.
  • Download applications only from trusted sources and verify their authenticity.
  • Ensure macOS, browsers and endpoint security tools are updated and supported.
  • Monitor suspicious Terminal activity, untrusted downloads, quarantine-attribute removal, unexpected executable launches and suspicious LaunchAgents or LaunchDaemons.
  • Use EDR or equivalent endpoint monitoring on macOS devices where available.
  • Enforce least privilege and restrict unauthorized software execution where feasible.
  • Review identity, email, cloud and privileged-account logs for suspicious activity.
  • If compromise is suspected, isolate the device where feasible, preserve evidence, revoke active sessions and refresh tokens, rotate exposed credentials from a known-clean device, and investigate possible data exfiltration.
  • Rebuild the endpoint from a trusted source if system integrity cannot be confidently restored.
  • Validate any indicators of compromise against the original research before blocking or using them for detection.

References: