Executive Summary
Jamf Threat Labs has identified a sophisticated macOS infostealer named AmnesiaStealer, distributed via 'ClickFix' social engineering lures that impersonate GitHub download pages. The malware is written in Rust and operates through a three-stage execution chain: a dropper script, an infostealer payload, and a second-stage streaming module that enables interactive remote control of the victim's browser.
AmnesiaStealer distinguishes itself from other macOS families like AMOS by including OS-specific logic to attempt TCC bypasses, such as recycling the CVE-2020-9771 APFS snapshot mount technique. Although some of these bypasses are mitigated in modern macOS versions, the malware's ability to phish for the login password and hijack authenticated browser sessions via the Chrome DevTools Protocol (CDP) presents a severe risk for credential and session theft.
The threat is actively evolving, as evidenced by its use of a builder-driven configuration and an operator-facing 'Amnesia Panel'. Its primary impact is the exfiltration of keychains, browser data, and sensitive documents, as well as the potential for live hands-on-keyboard activity within the victim's authenticated browser context.