AmnesiaStealer

The campaign uses ClickFix, a social-engineering trick that persuades people to run a command themselves. Victims are sent to a counterfeit GitHub download page, then told to copy a command into Terminal.

Jamf Threat Labs traced the campaign to a counterfeit GitHub-style page offering a macOS download.

Victims are sent to a counterfeit GitHub download page, then told to copy a command into Terminal. That command downloads and starts a multi-stage Rust-based payload while removing installation traces.

Victims are sent to a counterfeit GitHub download page, then told to copy a command into Terminal.

The campaign also establishes a disguised LaunchDaemon for persistence, making a one-time unsafe Terminal command capable of creating a longer-lived compromise.

To avoid the headless sessions from being flagged as automation by the sites visited by the malware, the module injects a script that patches several browser fingerprinting APIs.

The campaign also establishes a disguised LaunchDaemon for persistence, making a one-time unsafe Terminal command capable of creating a longer-lived compromise.

AmnesiaStealer establishes persistence through a LaunchDaemon masquerading as an Apple crash reporting component

That command downloads and starts a multi-stage Rust-based payload while removing installation traces.

Steal cookies from Safari based on the macOS version, using a TCC bypass flaw (CVE-2020-9771) to target macOS machines running Catalina.

the module launches a cloned browser profile in a hidden headless instance

To avoid the headless sessions from being flagged as automation by the sites visited by the malware, the module injects a script that patches several browser fingerprinting APIs.

Operators can see what appears in the browser and send keyboard or mouse input back to it.

Instead of sorting through exported data later, an attacker can act while a session is valid, including viewing account pages, moving through sign-in flows, exporting decrypted cookies, or importing cookies into another session.

the malware gathers credentials, browser records, Apple Notes, Telegram session data, documents, wallet-related browser data, and keychain material. | It also tries to obtain each browser’s Safe Storage key from the login keychain, potentially helping the later module read protected browser information.

To avoid the headless sessions from being flagged as automation by the sites visited by the malware, the module injects a script that patches several browser fingerprinting APIs.

The malware also attempts to recover each browser's Safe Storage key from the macOS login keychain for later use by the streaming module.

The Rust payload also performs host reconnaissance and geolocation profiling, and displays a native prompt to capture the system password under the guise of an installer.

The Rust payload also performs host reconnaissance and geolocation profiling

Stage one targets sixteen Chromium-family browsers, collecting cookies, login databases, history, bookmarks, extensions, Local State, Preferences, and related artifacts.

Operators can see what appears in the browser and send keyboard or mouse input back to it.

Enable or disable a clipboard-hijacking (aka clipper) module ("CLIPPER_ENABLED") capable of targeting cryptocurrencies like Bitcoin, Bitcoin Cash, Ethereum, TRON, Litecoin, Monero, Solana, Ripple, and Cosmos (ATOM).

It verifies that password locally, unlocks the login keychain, packages stolen material, and sends it to attacker-controlled infrastructure before setting up its persistence mechanism and cleaning up artifacts.

It also spawns a relay channel using WebSocket to accept operator commands and report the status back to the same endpoint. | It includes the following details - Command-and-control (C2) endpoints (i.e., "debug.allllowef[.]space/send/")

That command downloads and starts a multi-stage Rust-based payload while removing installation traces.

The module communicates through the Chrome DevTools Protocol, a legitimate browser interface intended for debugging. In the wrong hands, it lets an operator navigate sites, open and manage tabs, send keyboard and mouse actions, and view browser output in real time.

It verifies that password locally, unlocks the login keychain, packages stolen material, and sends it to attacker-controlled infrastructure before setting up its persistence mechanism and cleaning up artifacts.