AmnesiaStealer targets macOS users through ClickFix campaigns that deliver a password-protected ZIP archive containing the malware. It steals the victim's macOS password to access keychain data, browser profiles, Apple Notes, Telegram sessions, documents, system info, and cryptocurrency wallets. The malware supports 16 Chromium-based browsers and duplicates user profiles to launch a hidden headless browser instance with weakened defenses. Through two WebSocket channels, it establishes a remote control session using the Chrome DevTools Protocol, allowing the attacker to navigate websites, perform mouse and keyboard actions, export/import cookies, and operate online portals with the victim’s authenticated sessions. The malware streams a live screencast of the browser session at about 3 frames per second, providing the attacker interactive control. It also includes fallback mechanisms to maintain decryption capabilities on newer macOS versions. This is the first documented macOS malware combining cloned Chromium profiles with live remote control via CDP, significantly elevating the attacker's access beyond simple data theft.

AmnesiaStealer enables attackers to steal a wide range of sensitive data including passwords, cryptocurrency wallets, Apple Notes, Telegram sessions, documents, and macOS keychain data. The live remote control of authenticated browser sessions allows attackers to interactively use victims' online accounts and portals without needing to re-authenticate, effectively hijacking active sessions. This capability increases the potential for unauthorized transactions, data exfiltration, and further compromise. The malware’s ability to operate stealthily via a headless browser and stream live sessions represents a materially different and more dangerous level of access than traditional infostealers.

No official patch or remediation is currently available. Users should avoid executing unknown terminal commands and be cautious of downloading software from untrusted or fake sources such as counterfeit GitHub pages. Employ endpoint protection solutions capable of detecting malware behaviors and monitor for suspicious activity related to browser profile duplication or headless browser execution. Regularly update macOS and browsers to the latest versions to reduce exposure to exploitation of known vulnerabilities. Follow vendor advisories for any future updates or mitigation guidance.