AmnesiaStealer, a new macOS-oriented information stealer, has been uncovered by cybersecurity researchers. This multi-stage Rust-based malware spreads through a counterfeit GitHub download page, luring users with a ClickFix-style attack. Once executed, it employs a dropper script to deploy the stealer in three distinct stages, each with its own objectives and capabilities.
The first stage downloads and launches the payload, while the second stage, a Rust infostealer, harvests sensitive data such as Keychain, browser, Apple Notes, and Telegram information. The third stage, a stream_module, enables remote control of the victim's browser, providing attackers with live, interactive sessions.
One of the key features of AmnesiaStealer is its ability to target 16 Chromium-family browsers, including Google Chrome, Brave, Arc, and Microsoft Edge, to steal cookies, login data, and other sensitive information. It also reads Chrome Safe Storage passwords and uses them to recover master keys for data stored in the user's Chrome profile folder.
The malware also exploits a TCC bypass flaw in Safari to target macOS machines running Catalina and performs host reconnaissance and geolocation profiling. It establishes persistence through a root LaunchDaemon that impersonates Apple's crash reporting service and stages collected data in a directory named with 25 random alphanumeric characters under '/tmp'.
What sets AmnesiaStealer apart from other stealers like Atomic Stealer, MacSync, and CrashStealer is its builder-driven configuration, operating system version-branched logic, and a remote-control second stage that allows attackers to steal user cookies and evade detection through a stealth script that patches browser fingerprinting APIs.
The name AmnesiaStealer is derived from a login page located at the root of the C2 host, and the malware's objectives align with harvesting credentials, browser data, and live sessions from macOS users. Researchers emphasize the importance of tracking and understanding this malware due to its advanced capabilities and potential impact on users' privacy and security.
