AmnesiaStealer Exposed: How macOS Users Become Browser Botnets with Remote Session Hijacking

Intro: Jamf Threat Labs discovered a new macOS‑targeted malware called AmnesiaStealer. In addition to stealing keychains and browser data, it contains a third‑stage module named stream_module that launches a headless Chromium instance on the victim host and manipulates the logged‑in session via the Chrome DevTools Protocol, turning the victim into a browser botnet.

1. Distribution Chain: Fake GitHub + One‑Line Terminal Command

Attackers register a phishing domain github.aoitour[.]com that mimics GitHub’s UI, complete with a dark theme, Octocat logo, and a “Verified Publisher” badge. The page shows a “Download for macOS” title but provides a “Terminal installation” command box instead of a download button. The copyable command is a Base64‑encoded shell loader that, when decoded, fetches a script from /d/command, downloads a password‑protected ZIP (password: dulin) containing the Mach‑O payload, and renames the binary to /tmp/.com.apple.dt.<random> to resemble an Apple development tool.

Before execution, the loader runs three standard steps: chmod +x to make it executable, codesign --force --deep --sign - to apply a temporary self‑signature, and xattr -cr to clear quarantine attributes.

Jamf notes that this phishing page template is not unique to AmnesiaStealer; earlier macOS info‑stealers such as Atomic (AMOS) and MacSync used the same approach.

2. Three‑Stage Attack Chain: Rust‑Written Payload Reveals Developer Details

The malware consists of three stages:

Stage 0 – the shell loader described above.

Stage 1 – a FAT Mach‑O binary compiled with Rust, identified by SHA‑256 hash

de5748aac4a4d4cb48cf050652679e6bc49eda33d9ffaa0d280b578122fab55a

. The sample contains developer artefacts such as a .cargo directory ( /Users/admin/.cargo/), relative paths like target/release, and debug function names ( dump_mail, run_controller, /tmp/mail_accounts_smoke). The binary also embeds a 4 KB encrypted configuration blob decrypted with a 15‑byte XOR key 4mn3s1a_2o26!xK. Jamf extracted C2 endpoints, build parameters, BUILD_ID, and a token from this blob, indicating a “malware‑as‑a‑service” (MaaS) operation model.

Stage 2 – the stream_module. This module is not bundled with the main binary; it is fetched from the C2 after receiving the remote_stream command.

3. stream_module: Turning the Victim into a Live Browser Bot

Traditional info‑stealers stop at Stage 1, exfiltrating cookies, passwords, and keychain data. AmnesiaStealer’s Stage 2 instead clones the victim’s Chromium profile (covering Chrome, Edge, Vivaldi, Arc, Opera, Brave, and Chromium) and launches a legitimate browser executable with reduced defenses, loading the cloned profile.

The module then opens two WebSocket channels:

Channel 1 connects back to the attacker’s relay server, sending the browser name and build version as JSON. Through this channel the attacker can issue keyboard, mouse, scroll, navigation, and tab‑management commands, and receives a low‑frame‑rate (~3 fps) binary‑encoded screen stream, effectively a remote desktop.

Channel 2 connects to the local headless Chromium’s webSocketDebuggerUrl, the Chrome DevTools Protocol (CDP) endpoint. CDP allows programmatic control of the browser: navigation, clicks, input, cookie import/export, and any DevTools API, giving full access to the victim’s already‑authenticated sessions.

Jamf reproduced the attack in the lab: the attacker obtained a ~3 fps real‑time screen stream and could drive the browser with complete input, operating within the victim’s logged‑in sessions.

This capability means that compromised browsers can be used to access banking portals, email accounts, social‑media back‑ends, and enterprise SaaS without needing passwords or bypassing 2FA, rendering device‑fingerprint‑plus‑cookie defenses ineffective.

4. macOS 26 Trap: Deliberate Password Reset

On macOS 26, if the malware cannot recover the existing Chrome Safe Storage key, it replaces it with a key supplied by the attacker. Consequently, the victim’s locally stored cookies become permanently unreadable, while the attacker can decrypt them remotely using the new key.

5. Detection and Mitigation

Jamf published the SHA‑256 hash, associated domains, and URL paths. Recommended defenses for macOS users include:

Never paste unknown commands into Terminal.

Enable XProtect and Gatekeeper; avoid disabling them with xattr -cr.

Monitor for files matching /tmp/.com.apple.dt.*, which are not used by legitimate Apple processes.

Watch for abnormal long‑lived WebSocket connections to non‑business domains.

Deploy MDM solutions such as Jamf to centrally control application sources.

Use hardware security keys for high‑value accounts to bypass browser‑stored credentials.

Regularly rotate passwords and avoid relying on browser password managers.

Jamf’s report (13 August) indicates that AmnesiaStealer has been active in the wild for some time. While Rust‑based macOS malware is not new, AmnesiaStealer is the first recorded macOS family to distribute a stream_module that combines profile cloning with real‑time remote browser control via CDP.