AmnesiaStealer is a new macOS infostealer that does something previous Mac malware only hinted at: it clones your Chromium browser profile, launches it headless in the background, and hands an attacker live, interactive control of your authenticated sessions. Jamf Threat Labs discovered and analyzed the malware in August 2026 after it surfaced through ClickFix campaigns using fake GitHub download pages. The result is that a single infected Mac becomes a remote-controlled browser running under your identity, with your cookies, your banking sessions, and your SSO tokens intact.
The operator gets a live screencast at roughly 3 frames per second and can drive your browser with full keyboard and mouse input, navigation, and tab management. That is a different class of threat from a credential dump.
What is AmnesiaStealer and how does it reach macOS users?
AmnesiaStealer is a multi-stage, Rust-based macOS infostealer that Jamf tracks under that name because the malware's embedded configuration is decrypted with the key 4mn3s1a_2o26!xK, a reference to the Amnesia Panel backend it reports to. The binary is a universal (FAT) Mach-O with SHA-256 e853748ca8f9a5a9168263617409a9039ab09f4ffc7d860374c1e3b0b67b31a5.
Delivery follows a familiar ClickFix pattern. A counterfeit GitHub "Download for macOS" page lures the visitor into pasting a command into Terminal. That command executes a shell-script loader that downloads and launches a password-protected ZIP archive containing the Mach-O payload. Jamf notes that AmnesiaStealer reuses the same template previously deployed to spread the Atomic and MacSync infostealers, meaning the delivery infrastructure is recycled and already proven in the wild.
The malware has three stages. Stage 1 is the shell script that downloads and launches the payload. Stage 2 is a Rust infostealer that harvests the keychain, browsers, Apple Notes, and Telegram. Stage 3 is the stream_module, fetched on command, that gives the operator hidden, interactive control of the victim's browser.
How does the browser hijacking actually work?
This is where AmnesiaStealer breaks new ground for macOS threats. The stream_module responds to an operator command called remote_stream. When that command arrives, the module clones the victim's Chromium profile into a hidden directory at ~/.local/share/.stream/profiles/, copying Cookies, Login Data, Login Data For Account, Preferences, Secure Preferences, Local Storage, Session Storage, IndexedDB, and Local State. It then launches the browser's real executable in headless mode with --headless=old, --remote-debugging-port=, --remote-allow-origins=*, and a stack of flags that weaken browser defenses.
The victim's own visible browser is never touched and shows nothing. The operator gets a hidden copy running with the victim's authenticated sessions.
Two WebSocket channels make this work. The first connects out to the operator's relay and sends a JSON registration frame with the browser name and build ID. Commands arrive on this channel as tagged JSON: {"type":"navigate","url":"..."}, {"type":"mouse_click","x":...,"y":...,"button":"..."}, {"type":"export_cookies"}. The second channel connects to the local headless Chromium instance through the browser's webSocketDebuggerUrl, providing access to the Chrome DevTools Protocol (CDP).
Jamf describes the result plainly: the remote_stream command turns an infected host into a live, operator-driven browser running the victim's authenticated sessions, which is a materially different level of access from file collection.
The chart above shows the gap between AmnesiaStealer's data-theft scope and its live-control scope. The Rust infostealer stage can exfiltrate profile data from 16 Chromium-based browsers, but the stream_module's live CDP control works across 7 of them: Chrome, Brave, Microsoft Edge, Arc, Opera, Vivaldi, and Chromium. One implementation covers all seven because they share the same DevTools Protocol, launch flags, and cookie encryption. Only the executable path and profile location change per browser.
What does AmnesiaStealer actually exfiltrate from an infected Mac?
The data haul is broad. From Chromium browsers, AmnesiaStealer exfiltrates cookies, saved logins, browsing history, bookmarks, extensions, local state, and other profile data. It also steals cryptocurrency wallet details by enumerating extensions and IndexedDB data. Beyond browsers, the Rust payload captures the macOS login password through a native prompt, unlocks and copies the login and data-protection keychains, and exfiltrates Apple Notes, Telegram sessions, and documents.
The cookie theft has two paths. Through CDP, the module calls Network.getAllCookies and writes the result as a Netscape cookie file with decrypted, plaintext values. Through direct SQLite access, it opens the profile's Cookies database and re-encrypts every cookie with a hardcoded Safe Storage password (pqz8N3vKxRmY2aLcQ) that the operator already knows, so the exfiltrated profile can be decrypted operator-side. Jamf confirmed in lab testing that the CDP path succeeded, producing a Netscape cookie file with plaintext cookie values.
On macOS 26, the direct-SQLite re-encryption path fails because the malware cannot recover the existing Chrome Safe Storage key. Its fallback is destructive: it overwrites the key with the attacker-supplied value, rendering previously stored passwords and cookies permanently undecryptable while allowing the operator to decrypt anything encrypted afterward. The malware's own debug string labels this path provision fallback (destructive).
Why does live CDP control change your endpoint threat model?
If you run a fleet of Macs, this malware changes your endpoint threat model in three concrete ways.
First, session hijacking defeats MFA. An attacker driving a live browser session through CDP is not presenting a stolen cookie to a replay tool. They are operating the victim's own browser, with the right device fingerprint, the right cookies, and the right TLS context. Your SSO provider sees a legitimate session from a legitimate device. Conditional access policies that trust device state will not fire.
Second, the headless browser is invisible to the user. Because the module launches a separate headless instance against a cloned profile, the victim's visible browser shows nothing unusual. There is no redirected tab, no performance drag, no popup. An operator could drain a banking session, approve a wire transfer, or accept an OAuth consent prompt while the victim reads email in their actual browser window.
Third, cookie-based session theft is now interactive, not just automated. The operator can navigate, click, scroll, open tabs, and respond to challenges in real time. This is a hands-on-keyboard hidden browser session rather than an automated dump. Gridinsoft's analysis confirms the module supports tab management, mouse and keyboard input, and cookie import and export.
If your threat model assumed that macOS infostealers were limited to static file exfiltration, AmnesiaStealer is your correction. The same DevTools Protocol that powers your automated testing pipeline is now powering remote-controlled session theft. We have already covered how AI coding agent malware hides in clean GitHub repos, and the pattern here is adjacent: attackers are increasingly turning developer tooling into attack infrastructure.
How do you defend Mac fleets against CDP session hijacking?
AmnesiaStealer has no CVE and no patch because it is malware, not a vulnerability. Your defenses are operational.
-
Block the delivery vector. ClickFix attacks work by convincing a user to paste a terminal command. Train your team, but do not rely on training alone. Restrict Terminal execution for non-developer Macs where feasible, and consider endpoint tools that flag shell-script downloaders from user space.
-
Watch for headless Chromium launches. The module launches the real browser binary with
--headless=oldand--remote-debugging-port=flags. Any endpoint detection that sees Chrome, Brave, or Edge launching headless with remote debugging enabled from a user context should alert immediately. This is not normal user behavior. -
Monitor for CDP WebSocket connections. The module opens a WebSocket to
webSocketDebuggerUrlon the local debug port. If you run EDR on macOS, write a rule for outbound WebSocket connections from browser processes that coincide with local debugging port activity. -
Audit session revocation as a response. If a machine is compromised, revoking cookies is necessary but may be insufficient if the operator already exported a Netscape cookie file. Force re-authentication across all SSO-connected applications and rotate any API tokens that were stored in browser profiles.
-
Check for the persistence mechanism. Stage 1 installs a LaunchDaemon for persistence. Review LaunchDaemon and LaunchAgent directories on Mac endpoints for unfamiliar entries, especially those that reference
.local/share/.stream/paths.
Caveats: Jamf notes that several of AmnesiaStealer's macOS privilege-escalation bypasses are dated, including two TCC bypasses that fail on macOS 26. The APFS local-snapshot mount to reach Safari cookies and the Full Disk Access grant injected into TCC.db both no longer work. The malware's own debug strings record these failures. But the core capability, the browser hijack via CDP, works on current macOS.
The bottom line
AmnesiaStealer proves that the Chrome DevTools Protocol is now a live attack surface on macOS. The malware's dated bypasses are a footnote. The stream module is the story. An attacker who reaches a single Mac through a fake GitHub page can pivot to interactive control of every authenticated web session on that machine, with MFA bypassed by design. Treat browser sessions as credentials, because that is exactly how this attacker treats them.
Sources
- jamf.com - Jamf Threat Labs analysis of AmnesiaStealer
- bleepingcomputer.com - BleepingComputer coverage of AmnesiaStealer
- blog.gridinsoft.com - Gridinsoft technical analysis of AmnesiaStealer
- appleinsider.com - AppleInsider coverage of the fake GitHub download campaign
