AmnesiaStealer: macOS Malware Leveraging Fake GitHub Lures for Live Browser Hijacking

AmnesiaStealer is a sophisticated Rust-based infostealer targeting macOS users via "ClickFix" social engineering on counterfeit GitHub repositories. The malware utilizes a multi-stage execution flow to exfiltrate macOS Keychain data, saved passwords, and browser cookies from Safari and Chromium-based browsers. Critically, it leverages the Chrome DevTools Protocol (CDP) to grant remote operators live, real-time control over active browser sessions, allowing attackers to bypass multi-factor authentication (MFA) and facilitate immediate account takeover by manipulating the victim's authenticated browser instance.

• Incident & Campaign Overview

  • AmnesiaStealer is a high-fidelity infostealer implemented in Rust, specifically engineered to target the macOS ecosystem.
  • The campaign utilizes meticulously crafted clones of GitHub's dark theme to deceive developers and power users into executing malicious payloads.
  • The primary objective is the extraction of high-value authentication tokens and the establishment of persistent, operator-led session access.

• Attack Vector & "ClickFix" Mechanics

  • Employs the "ClickFix" technique, which tricks users into copying and executing malicious shell commands under the guise of resolving a fake installation or download error.
  • Uses high-fidelity social engineering to mimic official GitHub repository interfaces, minimizing user suspicion during the initial infection phase.
  • Utilizes a multi-stage execution chain to bypass basic security prompts and escalate privileges for system-level data access.

• Technical Deep Dive: Session Hijacking

  • Integrates the Chrome DevTools Protocol (CDP) to enable live, remote operator control over active browser instances.
  • This capability allows attackers to interact with websites in real-time as the authenticated user, effectively neutralizing traditional session-based MFA.
  • Specifically targets Google Chrome and other Chromium-based browsers to exploit the CDP interface for remote manipulation.

• Impact & Data Exfiltration

  • Exfiltrates sensitive macOS Keychain data, granting attackers access to stored system credentials and application passwords.
  • Steals browser cookies and saved passwords to facilitate rapid account takeover (ATO) across multiple web services.
  • Enables deep exploitation of the victim's digital identity through the combination of static credential theft and dynamic session control.

• Defensive Actions & Mitigation

  • Implement strict endpoint detection and response (EDR) monitoring for unauthorized shell commands initiated via browser-based social engineering.
  • Educate technical staff on the "ClickFix" pattern, specifically the danger of pasting commands from untrusted web pages into the terminal.
  • Transition to hardware-based MFA (e.g., FIDO2/WebAuthn) to reduce the utility of stolen session cookies and browser hijacking.