AmnesiaStealer macOS Malware Hijacks Live Browser Sessions via Remote Control

AmnesiaStealer is a new macOS information stealer that does more than copy files: it can remote-control the victim's web browser and clone their Chromium profile, including its live authentication state, into a hidden headless browser on the infected Mac. That lets the operator step directly into the victim's already-logged-in sessions while keeping the browser, host, and network identifiers the real user had, which sidesteps the anomaly checks that normally catch a stolen cookie. It spreads through ClickFix attacks using a fake GitHub download, and it harvests keychain data, passwords, crypto wallets, and more across 16 Chromium browsers. Jamf analyzed the malware and its delivery in mid-August 2026.

The session-hijacking design is what sets AmnesiaStealer apart from the usual Mac stealer. Conventional infostealers exfiltrate cookie databases to a remote server, where replaying them from attacker infrastructure often trips geolocation, ASN, or TLS-fingerprint mismatches. AmnesiaStealer instead operates from inside the victim's machine: its stream_module, triggered by a remote_stream command, spins up a hidden headless browser loaded with the copied profile, so requests originate from the victim's own residential or corporate IP with their genuine device identity. Even token-binding and short-lived-session defenses are weakened, because the malware is acting inside the authorized profile state rather than replaying a stolen credential elsewhere.

The delivery is textbook ClickFix. Victims land on a fake GitHub download page and are guided to run a shell command that pulls a password-protected ZIP holding the AmnesiaStealer Mach-O payload, the same template Jamf previously saw spreading the Atomic and MacSync stealers. The malware then captures the user's macOS password to unlock keychain data and sweeps up browser profiles, Apple Notes, Telegram sessions, documents, system information, and cryptocurrency wallets.

Do passkeys or MFA stop AmnesiaStealer?

Only partly. Passkeys and MFA protect the initial login, but once you are authenticated and that session is cached in the browser profile, the cloned headless instance inherits the live session and stays valid until something forces a fresh re-authentication. In other words, strong login does not help much against a threat that skips the login entirely and rides the session you already established. Step-up authentication on sensitive actions is what actually interrupts it, because it demands a fresh human check the cloned session cannot satisfy.

How do defenders detect this on macOS?

Watch process behavior, not just files. Alert when an unsigned or suspicious binary launches a Chromium browser with arguments like --headless, --remote-debugging-port, or a --user-data-dir pointing at /tmp or a hidden directory. Flag non-browser processes reading ~/Library/Application Support/Google/Chrome/Default/ or touching the macOS keychain from the command line (security dump-keychain). Because delivery runs through the Terminal, add EDR rules for obfuscated or base64-encoded curl payloads pasted into a shell, since ClickFix depends on the user executing that command by hand, which also bypasses the quarantine flag Gatekeeper relies on.

Our read

Understanding risk here means seeing that the industry moved authentication forward while session integrity stayed behind. AmnesiaStealer does not break your login; it makes the login irrelevant by cloning what happens after it, from a context that looks entirely legitimate. That is a continuous-verification problem: the signal that matters is not "did the user authenticate" but "is this session still being driven by the real user on a trusted device," evaluated continuously rather than once at sign-in. Enforce step-up auth on sensitive actions, hunt for headless-browser process lineage, and treat the browser profile as the crown-jewel credential store it has quietly become.

Reporting by BleepingComputer and SecurityWeek, citing Jamf. Sources linked above.

Related: 737 Chrome VPN extensions hijack browser traffic · Passkey attacks that bypass phishing-resistant MFA