AmnesiaStealer, a new macOS-oriented information stealer, has been uncovered by cybersecurity researchers. This multi-stage Rust-based malware spreads through a deceptive GitHub download page, luring users with a ClickFix-style attack. Once executed, it employs a sophisticated chain of commands to deploy the stealer, which can hijack Chromium web browsers and steal sensitive session data.
The attack begins with a shell script that downloads and launches the payload. This is followed by a Rust infostealer, which harvests data from various sources, including Keychain, browsers, Apple Notes, and Telegram. The third stage is a stream_module, which gives the operator hidden, interactive control of the victim's browser.
One of the most concerning aspects of AmnesiaStealer is its ability to remotely control the browser, allowing attackers to steal user cookies and evade detection. This is achieved through a stealth script that patches browser fingerprinting APIs, ensuring that the malware's activities go unnoticed.
The malware targets 16 Chromium-family browsers, including Google Chrome, Brave, Arc, and Microsoft Edge, to gather cookies, login data, and other sensitive information. It also reads Chrome Safe Storage passwords and uses them to recover master keys, further compromising user data.
AmnesiaStealer's name is derived from a login page located on the C2 host, and it sets out to harvest credentials, browser data, and live sessions from macOS users. Its effectiveness lies in its ability to bypass Apple's security measures and its remote-control capabilities, making it a significant threat to macOS users.
This discovery highlights the evolving nature of cyber threats and the need for continuous vigilance in protecting sensitive data. As cybersecurity researchers uncover new malware, it becomes increasingly important for users to stay informed and take proactive measures to safeguard their digital assets.
