Amnesia Stealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS

Summary: Jamf Threat Labs disclosed a Rust-based macOS infostealer called AmnesiaStealer, spread through a counterfeit GitHub page using a ClickFix lure that has users paste a Base64-encoded command into Terminal, which then runs a three-stage chain: a shell script dropper, a Rust stealer harvesting Keychain, browsers, Apple Notes and Telegram, and a stream_module fetched on command. That module launches seven Chromium-family browsers in headless mode over the Chrome DevTools Protocol and gives the operator a live session at roughly 3fps with keyboard, mouse, scroll, navigation and tab control, while a script patches browser fingerprinting APIs to avoid automation flags.
Why it matters: The captured system password is validated via dscl, reused for sudo -S and security unlock-keychain, and written in cleartext to ~/.pwd - so one pasted Terminal command hands over the machine and the authenticated browser sessions on it, not just files.

Read the original at The Hacker News ↗