Key Takeaways
What is AmnesiaStealer?
At first glance, AmnesiaStealer appears to be another capable macOS infostealer. It harvests credentials, browser data, documents, messaging data, and keychain contents using techniques commonly observed across modern macOS malware. However, stopping the analysis there misses what makes this family noteworthy.
The defining capability is not the information theft itself but what happens after collection. Rather than treating browser databases as the final objective, AmnesiaStealer can retrieve a dedicated Stage 2 streaming module that clones the victim's browser profile, launches it in a hidden headless instance, and allows an operator to directly interact with authenticated browser sessions through the Chrome DevTools Protocol. This shifts the malware beyond simple credential theft toward interactive post-compromise browser access.
The malware also demonstrates a mature development model. Jamf identified builder-generated configurations containing encrypted campaign-specific settings, configurable infrastructure, build identifiers, and operating system version-aware execution paths. Rather than relying on a single collection technique, AmnesiaStealer adapts portions of its execution based on the victim's macOS version while retaining older collection methods that have since been mitigated by Apple.
Technical Analysis
Initial access begins with a counterfeit GitHub page designed to closely resemble GitHub's legitimate software download experience. Rather than offering a download, the page instructs users to copy and execute a Terminal command, initiating a shell script that silently downloads, extracts, signs, and launches the primary Rust payload before deleting installer artifacts.
Once running, AmnesiaStealer profiles the host, presents a native Installer-themed password prompt, validates the supplied credentials locally, unlocks the user's login keychain, and begins collecting browser information, Apple Notes, Telegram session data, wallet-related browser artifacts, documents, and additional system information. The collected data is staged, archived, and exfiltrated before persistence is established using a LaunchDaemon impersonating Apple crash reporting.
Stage 1 targets sixteen Chromium-family browsers, copying cookies, login databases, browser history, bookmarks, extension data, Local State, Preferences, and related browser artifacts. The malware also attempts to recover each browser's Safe Storage key from the macOS login keychain for later use by the streaming module.
When instructed by the operator, the malware retrieves its Stage 2 streaming component. Supporting seven Chromium-family browsers, the module launches a cloned browser profile in a hidden headless instance and establishes a remote control channel over the Chrome DevTools Protocol. Jamf observed operators being able to navigate websites, control keyboard and mouse input, manage browser tabs, capture live browser output, export decrypted plaintext cookies, and import cookies into browser sessions. The result is an operator-controlled browser running the victim's authenticated sessions without interacting with the victim's visible browser window.
What Makes AmnesiaStealer Different?
Jamf notes that AmnesiaStealer shares objectives with Atomic Stealer (AMOS), MacSync, and CrashStealer while also observing the same counterfeit GitHub lure previously used in Atomic and MacSync campaigns. However, several architectural characteristics distinguish AmnesiaStealer from many existing macOS stealers, including its builder-generated configuration model, operating system version-aware execution logic, and dedicated browser streaming capability.
The report also highlights that the malware continues attempting several legacy macOS collection and TCC bypass techniques that Apple has already mitigated. Rather than indicating outdated development, these routines appear to be incorporated into broader version-dependent execution logic that allows the malware to adjust its behavior according to the victim's operating system.
Analyst Commentary
The most interesting aspect of AmnesiaStealer is not what it steals but what it considers valuable.
Traditional infostealers are built around a simple model meant to collect as much data as possible, exfiltrate it, and let the operator determine what can be monetized or operationalized later. AmnesiaStealer takes a different approach. Browser databases become only one step in a larger objective centered on obtaining interactive access to authenticated browser sessions. That represents a meaningful shift in post-compromise tradecraft and demonstrates that, for some operators, the browser itself has become the target rather than merely another source of credentials.
The malware's builder-driven architecture reinforces this trend. Campaign-specific infrastructure, encrypted configuration data, build identifiers, and operating system-specific execution paths allow individual builds to change while preserving the underlying operational workflow. As malware development becomes increasingly modular, static indicators such as hashes, filenames, or domains provide progressively shorter-lived defensive value. Behavioral patterns, including ClickFix-driven Terminal execution, abnormal keychain access, LaunchDaemon persistence, browser profile cloning, and hidden Chromium execution, become far more durable detection opportunities.
This is precisely the type of threat that benefits from PolySwarm's multi-engine intelligence model. Builder-generated malware is designed to produce new artifacts quickly, reducing the lifespan of individual signatures while maintaining consistent functionality. PolySwarm's diverse detection ecosystem increases the likelihood that newly generated variants, related payloads, or emerging campaign samples are identified even when detection coverage varies between individual vendors. Rather than depending on a single security engine to recognize the next build, defenders gain visibility across dozens of independent detection technologies evaluating the same artifact.
As malware families continue adopting builder-driven development and increasingly modular post-compromise capabilities, successful defense will rely less on identifying one specific sample and more on rapidly recognizing evolving variants and shared behaviors. AmnesiaStealer illustrates why combining behavioral analytics with multi-engine malware intelligence provides stronger resilience against rapidly changing malware ecosystems than relying on static indicators alone.
IOCs
PolySwarm has a sample associated with this activity.
1edb978783394b946ee6d27510564aa56af1f033b08e2b90fa2c35bc4f495a93
Click here to view all samples of AmnesiaStealer in our PolySwarm portal.
Don’t have a PolySwarm account? Go here to sign up for a free Community plan or subscribe.
Contact us at hivemind@polyswarm.io | Check out our blog | Subscribe to our reports.