Affected Systems

macOS users targeted via ClickFix campaigns using fake GitHub pages. Affects 16 Chromium-based browsers including Chrome, Edge, Brave, Opera, Vivaldi, Arc, and Chromium. Also targets cryptocurrency wallets, Apple Notes, Keychain data, Telegram sessions, and documents.

Exploitation Status

Active exploitation confirmed. AmnesiaStealer is being distributed through ClickFix campaigns using fake GitHub download pages that deliver password-protected ZIP archives containing the Mach-O payload. Same distribution template previously used for Atomic and MacSync infostealers.

Business Impact

Attackers gain live, interactive control of authenticated browser sessions through a hidden headless browser running on infected macOS systems. The stream_module provides real-time screencast at 3fps with full keyboard and mouse control, enabling session hijacking without triggering re-authentication. Cloned Chromium profiles preserve authentication state, browser fingerprints, and network identifiers, bypassing typical fraud detection. Exfiltrates credentials, cookies, browsing history, cryptocurrency wallets, keychain data, and documents. On macOS 26, malware permanently corrupts existing Chrome Safe Storage keys, making stored passwords unreadable even after remediation.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Block execution of shell scripts downloaded from untrusted sources; enforce Gatekeeper and notarization requirements on macOS endpoints
  • Monitor for suspicious Chrome DevTools Protocol (CDP) WebSocket connections and headless browser launches with weakened security flags (e.g., --remote-debugging-port, --disable-web-security)
  • Deploy EDR solutions with macOS visibility to detect unauthorized access to browser profile directories (~/Library/Application Support/Google/Chrome, ~/Library/Application Support/Microsoft Edge, etc.)
  • Educate users to never execute terminal commands from online sources, especially those involving curl, bash, or base64-encoded payloads
  • Implement network monitoring for WebSocket traffic to unknown relay servers; correlate with browser process telemetry to identify remote control activity
  • Force password resets and session invalidation for users who executed suspicious terminal commands or downloaded files from fake GitHub pages