AmnesiaStealer Hijacks Chromium Browsers on macOS

Summary

AmnesiaStealer is a multi-stage Rust-based macOS infostealer distributed through counterfeit GitHub pages using the ClickFix technique. The malware targets Keychain data, Apple Notes, Telegram, and Chromium-based browsers. A notable second-stage module gives operators live, headless remote control over compromised browser sessions through the Chrome DevTools Protocol.

Investigation

Jamf Threat Labs analyzed the malware’s three-stage execution chain, beginning with a shell script dropper, followed by a Rust-based infostealer and a final streaming module. Researchers detonated the sample in a sandbox to observe TCC bypass attempts, Keychain harvesting, and browser profile cloning. The analysis also showed how the malware rewrites Chrome Safe Storage keys to enable operator-side decryption.

Mitigation

Organizations should educate users not to paste commands into Terminal from untrusted websites. Strong endpoint protection should monitor for unauthorized TCC database modifications and unusual activity involving the Finder process. Restricting administrative privileges can also reduce the likelihood of successful LaunchDaemon persistence.

Response

If AmnesiaStealer activity is detected, the affected macOS host should be isolated immediately to stop data exfiltration and remote browser control. Investigators should search for unauthorized LaunchDaemons and suspicious files in /tmp/. All credentials and active sessions stored in browsers or Keychain should be revoked and treated as compromised.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has successfully tricked a user into downloading a malicious package via a “ClickFix” social engineering attack. To execute the payload, the attacker must bypass macOS’s Gatekeeper and security protections. The attacker will: 1) Create a dummy binary; 2) Use xattr -cr to strip all extended attributes (removing the “downloaded from internet” quarantine flag); 3) Use chmod +x to make the file executable; 4) Use codesign to apply an ad-hoc signature to prevent execution blocks; and 5) Use nohup to ensure the stealer continues running even if the terminal session ends. This sequence mimics the high-signal behavior of AmnesiaStealer.

• Regression Test Script:

  #!/bin/bash
  # AmnesiaStealer Simulation Script
  
  # 1. Setup: Create a dummy malicious binary
  echo "#!/bin/bash" > /tmp/amnesia_payload.sh
  echo "echo 'Stealing credentials...'" >> /tmp/amnesia_payload.sh
  
  # 2. T1564.011 / T1027.005: Strip quarantine attributes
  xattr -cr /tmp/amnesia_payload.sh
  
  # 3. T1588.003: Make the file executable
  chmod +x /tmp/amnesia_payload.sh
  
  # 4. T1553.001: Ad-hoc code signing
  codesign --force --deep --sign - /tmp/amnesia_payload.sh
  
  # 5. T1053 / T1059: Execute with nohup and simulate sudo usage
  # Note: sudo command is simulated with a dummy echo to avoid actual password prompts in a test environment
  nohup /tmp/amnesia_payload.sh > /tmp/stealer.log 2>&1 &
  echo 'password123' | sudo -S /usr/bin/whoami

• Cleanup Commands:

  # Remove simulation artifacts
  rm /tmp/amnesia_payload.sh
  rm /tmp/baseline_test.txt
  rm /tmp/stealer.log