MalwarePublished 14 Aug 2026

AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions

Source SecurityWeek

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2020-9771

Description

The Rust-based macOS infostealer harvests users’ passwords, keychain information, Chromium-based browser data, and Safari cookies. The post AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions appeared first on SecurityWeek .

Impact

The malware compromises user credentials, keychain data, browser cookies, and documents, potentially exposing sensitive personal and corporate information. By overwriting encryption keys, it renders previously saved browser passwords and cookies unrecoverable by the user but decryptable by the attacker. The remote-control module allows attackers to interactively control browser sessions, increasing the risk of further compromise or data theft. The use of TCC bypasses and persistence mechanisms increases the stealth and longevity of the infection. This poses a significant privacy and security risk to affected macOS users.

Defensive guidance

Mitigation focuses on user education to avoid executing commands from untrusted sources, especially in Terminal. Organizations should monitor for suspicious LaunchDaemon installations and unusual network traffic to command-and-control servers. Applying the latest macOS security updates may help mitigate some bypass techniques, but the malware uses known bypasses that may still be effective. Endpoint protection solutions with macOS malware detection capabilities should be employed. Users should avoid downloading software from unverified sources such as counterfeit GitHub pages.

References

securityweek.com/amnesiastealer-macos-malware-steals-data-controls-browser-sessions/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 14 Aug 2026, 06:56 UTC

References

Community reviews

Related threats