AmnesiaStealer Hijacks Your Web Browser on macOS

In a new ClickFix attack iteration, hackers are pushing an infostealing malware to macOS users that is capable of hijacking your sessions in Google Chrome, Microsoft Edge, and a number of other Chromium-based browsers. AmnesiaStealer grants remote control of your browser and access to plenty of personal data, so you should know how to spot the campaign and protect your device from compromise.

AmnesiaStealer can copy a victim’s Chromium profile, which allows it to collect data across 16 Chromium-based web browsers, access authenticated sessions, and control them remotely. This means threat actors can navigate across websites, export or import cookies, and access online portals as well as grab saved logins, history, bookmarks, extensions, and cryptocurrency wallet data. AmnesiaStealer can also capture your macOS password and gain access to keychain data, Apple Notes, Telegram sessions, documents, and system information.

How AmnesiaStealer is Distributed

Researchers at security company Jamf found that hackers are distributing the malware via a password-protected ZIP archive on a fake GitHub page. This is a common tactic used by threat actors to gain the trust of their victims. The fake GitHub page has a ‘Verified Publisher’ tag to make it appear legitimate. It is essential to be highly skeptical of any prompts you find online and never execute commands in Terminal from non-official sources.

The campaign mirrors previously identified Atomic and MacSync infostealers. Threat actors count on you believing that these commands do something innocuous, like download legitimate software, or not understanding what you’re executing on your device. This is why it’s crucial to be cautious when interacting with online prompts and never copy and paste commands in your system dialogue even if you believe you’re interacting with a trusted business or service.

Protecting Yourself from Browser Takeover Attempts

The best way to protect yourself from AmnesiaStealer is to be vigilant against ClickFix attacks, which use social engineering tactics to deliver malware to your device. Common tricks include fake error messages, CAPTCHA forms, and command prompts that install malicious payloads that can then spy on your activity, steal your data, and take over your machine.

Threat actors will try to impersonate legitimate companies—tech support scams are one example—so you should never copy and paste commands in your system dialogue even if you believe you’re interacting with a trusted business or service. To avoid browser takeover attempts, never execute commands in Terminal from non-official sources, and be highly skeptical of any prompts you find online.

It’s also essential to keep your macOS and browser software up-to-date, as this will help protect you from known vulnerabilities. Additionally, using a reputable antivirus software can help detect and prevent malware infections.

By being cautious and taking the necessary precautions, you can protect yourself from AmnesiaStealer and other malware threats. Remember, it’s always better to be safe than sorry when it comes to your online security.

AmnesiaStealer is a sophisticated malware that can take over your web browser and access sensitive personal data. However, by being aware of the threat and taking the necessary precautions, you can protect yourself from this and other malware threats.