Insights, news, education and announcements from PolySwarm | macOS infostealer malware

AmnesiaStealer Introduces Interactive Browser Session Hijacking to macOS

Aug 21, 2026, 3:13:30 PM / by The Hivemind posted in Threat Bulletin, macOS infostealer malware, Chromium browser session hijacking, AmnesiaStealer malware, AmnesiaStealer macOS infostealer, ClickFix macOS malware, fake GitHub malware campaign, macOS credential stealing malware

Executive Summary

Industry researchers identified AmnesiaStealer, a multi-stage Rust-based macOS infostealer distributed through a ClickFix social engineering campaign. Victims are lured to a counterfeit GitHub download page and instructed to execute a Terminal command that deploys a three-stage malware payload capable of harvesting credentials, browser data, Apple Notes, Telegram session data, documents, and keychain contents. While these capabilities are consistent with modern macOS information stealers, AmnesiaStealer distinguishes itself through a dedicated Stage 2 browser streaming module that provides operators with hidden, interactive control of Chromium-based browsers via the Chrome DevTools Protocol (CDP). Rather than simply stealing browser artifacts for offline analysis, the malware enables attackers to directly abuse authenticated browser sessions after compromise.

Read More