FlagThis — Daily Cybersecurity Intelligence Briefing

AmnesiaStealer is a sophisticated Rust-based infostealer targeting macOS users via "ClickFix" social engineering on counterfeit GitHub repositories. The malware utilizes a multi-stage execution flow to exfiltrate macOS Keychain data, saved passwords, and browser cookies from Safari and Chromium-based browsers. Critically, it leverages the Chrome DevTools Protocol (CDP) to grant remote operators live, real-time control over active browser sessions, allowing attackers to bypass multi-factor authentication (MFA) and facilitate immediate account takeover by manipulating the victim's authenticated browser instance.

A large-scale exfiltration campaign has targeted Azure/Entra ID tenants across multiple Fortune 500 organizations, resulting in the leakage of millions of internal employee records. The threat actor, identified as 'TheHatman,' utilized compromised credentials—likely obtained via Infostealer-driven session token theft—to access corporate directories through Azure/Entra portals and the Azure CLI. Exfiltrated datasets comprise core identities, detailed organizational metadata, and sensitive access control information, including service account listings and Global Administrator records. This breach provides high-value intelligence that significantly facilitates downstream high-impact attacks, such as Business Email Compromise (BEC), advanced spear-phishing, and ransomware deployment through lateral movement and privilege escalation.

Threat actors are deploying the AMOS Stealer on macOS by adapting the "ClickFix" social engineering technique. The attack leverages browser-based lures masquerading as AI tool errors (e.g., ChatGPT, Grok), prompting users to manually copy and execute a malicious command in the macOS Terminal. This sequence bypasses browser security and Gatekeeper by utilizing curl or wget to download a DMG file, which is then silently mounted via hdiutil. The primary objective is the exfiltration of browser passwords, session cookies, and cryptocurrency wallets.

Lumma Stealer has evolved its execution chain to bypass Google Chrome's App-Bound Encryption (ABE) by transitioning from offline file decryption to "living-off-the-browser" techniques. By utilizing Asynchronous Procedure Call (APC) and Remote Thread Injection into chrome.exe, or leveraging malicious Chrome extensions, the malware forces the legitimate browser process to decrypt sensitive data using its own internal APIs. This allows attackers to exfiltrate session cookies and non-custodial cryptocurrency wallet seeds, effectively neutralizing ABE and enabling MFA bypass via session hijacking. Impact is concentrated on high-value digital assets and corporate account access via SEO poisoning and malvertising delivery vectors.

Infostealer malware, specifically families such as Katz, Bee, and Acreed, has seen an 800% increase in activity, accelerating a shift toward identity-centric attack vectors. These threats target consumer devices via malvertising, phishing, and cracked software to exfiltrate browser cookies, session tokens, and saved credentials. By harvesting valid session data, attackers bypass Multi-Factor Authentication (MFA) through session hijacking. This data is subsequently commoditized through Initial Access Broker (IAB) marketplaces and Telegram-based distribution, providing the requisite access for enterprise-grade ransomware deployment and large-scale espionage operations.

Threat actors are leveraging the ChatGPT "shared chat" feature to execute a sophisticated phishing campaign that bypasses corporate security infrastructure. By hosting fraudulent service outage notifications on the trusted chatgpt.com/share/ domain, attackers utilize domain reputation hijacking to circumvent Secure Web Gateways (SWG) and URL filters. The campaign redirects targets to download malicious, fake ChatGPT desktop applications for Windows (.exe) and macOS (.dmg/.pkg). These payloads deliver infostealer malware designed to exfiltrate browser cookies, session tokens, and sensitive system credentials, posing a critical risk of account takeover (ATO) and large-scale corporate data exfiltration.

A malvertising campaign targets developers and Windows users by impersonating official Node.js and Deno installers through sponsored Google Ads. The attack chain deploys OXLOADER to facilitate the execution of CASTLESTEALER, CastleRAT, or Stealit malware. A primary technical innovation is the abuse of Node.js Single Executable Applications (SEA) and the Deno runtime to encapsulate malicious payloads. By executing within these legitimate JavaScript environments, the malware evades traditional EDR/AV solutions that trust common developer binaries. The impact includes the theft of sensitive credentials, API keys, and tokens, creating significant risks for developer workstations and potential supply chain contamination.

Ultrahuman suffered a data breach resulting in the unauthorized exfiltration of sensitive customer wellness and biometric telemetry. The attack originated from an Infostealer malware infection on a corporate employee's laptop, which allowed threat actors to harvest credentials and move laterally into internal wellness data repositories. While financial data and user passwords remained secure, the breach exposed highly personal health metrics, including heart rate variability, sleep cycles, and blood glucose trends. This incident underscores critical vulnerabilities in endpoint security and privileged access management (PAM) within the wearable health technology sector.