A new macOS infostealer dubbed AmnesiaStealer has emerged in 2026, distributed via ClickFix social engineering attacks that leverage counterfeit GitHub pages and automated script execution. Researchers warn the Rust-based malware targets credentials, browser data, and Telegram sessions while utilizing remote-controlled browser monitoring to maintain stealth.
Threat actors distributing macOS malware have updated their operational tradecraft. Rather than relying solely on traditional disk images for manual installation, attackers are using sophisticated ClickFix social-engineering techniques that persuade users to copy and execute Terminal commands. This approach bypasses standard macOS application trust paths, including quarantine handling, code-signing evaluation, and notarization checks normally applied to downloaded applications, according to Microsoft Threat Intelligence tracking.
How AmnesiaStealer Infects macOS Devices
Discovered by researchers at Jamf, AmnesiaStealer deploys a multi-stage infection chain after a user interacts with a counterfeit GitHub download page. The malicious landing page presents a Terminal installation
box framed as a convenience for advanced users, complete with numbered instructions. When a victim clicks the copy button, a base64-encoded blob is produced, decoding to a short, silent, and self-deleting command that retrieves and executes the malware binary.
Once running, the infostealer initiates reconnaissance across software, hardware, and display data types. To prevent detection, the malware actively mutes the device sound system. Finder plays a sound on each file it duplicates, so silencing the system hides the audio cues generated during data theft. The malware then harvests records from Apple Notes and Telegram, executing commands carefully constructed to avoid triggering macOS Transparency, Consent, and Control (TCC) permission prompts.
- The malware prompts the victim to enter their password, which is validated locally.
- The credentials unlock data-protection keychain files holding encrypted records.
- Collected data is staged in a directory, archived, and prepared for exfiltration.
Server-Side Cloaking and Browser Infostealer Campaigns
The delivery infrastructure behind these campaigns has evolved significantly. Microsoft Threat Intelligence observed a large cluster of algorithmically generated domains utilizing the token file
alongside dictionary words—such as filecopperbasket, filevelvettractor, fileoceanhammer, and filemarblegarden—to distribute MacSync, Atomic Stealer (AMOS), and related payloads.
Rather than exposing malicious command strings directly in the HTML source, the operation now uses server-side browser-fingerprinting gates. A visitor’s environment is profiled per request. Requests originating from genuine macOS browsers receive the forged Download for macOS
page complete with a fake Verified Publisher
badge and a copy button for an obfuscated curl one-liner. Conversely, requests from Windows browsers or automated crawlers receive decoy pages, such as fake browser extensions, VPN landing pages, or logistics company impersonations.
This dynamic cloaking limits visibility for automated analysis workflows and sandboxes. Researchers emphasize that receiving a benign or look-alike decoy page does not confirm that a domain is safe, because the server makes routing decisions on a per-request basis.
Remote Control and Post-Infection Capabilities
Beyond initial harvesting, AmnesiaStealer incorporates a remote-controlled second stage designed for live interaction.
This browser control module supports seven Chromium-family browsers, including Chrome, Brave, Microsoft Edge, Arc, Opera, Vivaldi, and Chromium. To stay hidden from the victim, the module clones the target user profile before launch, ensuring operators take command of the background copy rather than the visible browser instance. Operators receive a live screencast of the session, complete with keyboard, mouse, scroll, navigation, and tab management capabilities.
Cookie data is extracted in plaintext over the DevTools protocol. The module injects scripts specifically designed to prevent target websites from flagging the automated session.
To counter these threats, security teams recommend configuring threat prevention, advanced threat controls, and web protection tools to Block and Report to help prevent the execution of similar threats.
