AmnesiaStealer Uses Interactive Browser Hijacking on macOS

Summary

AmnesiaStealer is a multi-stage Rust-based macOS infostealer distributed through ClickFix social engineering campaigns that use counterfeit GitHub pages. Unlike conventional stealers, it includes a Stage 2 module that abuses the Chrome DevTools Protocol to provide hidden, interactive control over Chromium-based browser sessions. The malware steals credentials, Keychain data, and messaging session information before establishing persistence through a disguised LaunchDaemon.

Investigation

Researchers traced the malware’s delivery to shell commands presented on fraudulent GitHub pages and executed by victims. Analysis uncovered a sophisticated builder-generated architecture supporting OS-version-aware execution and modular payload deployment. The investigation highlighted AmnesiaStealer’s evolution from basic data exfiltration toward active browser session hijacking through headless Chromium instances.

Mitigation

Defenders should monitor for abnormal Terminal commands launched after browser activity and detect unauthorized LaunchDaemon creation. Strict controls around Keychain access and monitoring for unexpected processes using the Chrome DevTools Protocol can help reduce exposure. Users should also be trained not to execute unverified shell commands provided by websites.

Response

If AmnesiaStealer activity is detected, the affected macOS host should be isolated immediately to stop further session hijacking and data exfiltration. Investigators should review LaunchDaemons and Keychain access activity to determine the scope of compromise. All active web sessions should be revoked, and credentials stored in macOS Keychain or browser profiles should be rotated.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary aims to deploy the AmnesiaStealer Rust payload. To minimize the footprint, they use a single-line shell command that chains multiple operations. The command will purposefully use the keywords download, extract, sign, and launch within a single command string to trigger the specific wildcard detection logic. Following execution, the script will attempt to remove the installer to hinder forensic investigation.

• Regression Test Script:

  #!/bin/bash
  # Simulation script for AmnesiaStealer detection validation
  
  echo "[+] Starting Simulation: AmnesiaStealer Payload Execution"
  
  # 1. Simulate the specific command pattern the rule is looking for
  # This command uses the exact keywords in a single string to trigger the 'selection' logic.
  echo "[+] Executing detection trigger command..."
  /bin/sh -c "echo 'Simulating: download payload, extract archive, sign binary, and launch process' && sleep 2"
  
  # 2. Simulate the artifact deletion pattern
  echo "[+] Executing cleanup command..."
  /bin/rm -rf ./installer_artifacts_temp_dir
  
  echo "[+] Simulation Complete. Check SIEM for alerts."

• Cleanup Commands:

  # Cleanup simulation files/directories
  rm -rf ./installer_artifacts_temp_dir