Loading story…
Researchers reported a new macOS infostealer, AmnesiaStealer, being spread through ClickFix-style social engineering that tricks users into copying and pasting a malicious command into Terminal, including via fake GitHub download pages. The multi-stage infection chain uses a Bash loader to profile the host and retrieve a processor-specific Mach-O payload written in Go, then steals browser passwords, Apple Keychain data, cached credentials, Telegram sessions, Apple Notes, documents, and other sensitive information from infected systems.
Investigators said the malware also includes cryptocurrency-theft functionality that can transfer wallet funds to attacker-controlled addresses, and a later-stage component, stream_module, can be fetched on demand to clone browser profiles and attach to the Chrome DevTools Protocol for covert access to already authenticated browser sessions. Huntress linked parts of the loader, payload-hosting, and command-and-control infrastructure to the Aeza Group, a sanctioned Russian bulletproof hosting provider tied to cybercrime, while Jamf noted some privacy-bypass methods are outdated on newer macOS releases even though the malware’s credential theft and session-hijacking features remain effective.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Huntress said it observed a new macOS infostealing malware campaign in June 2026. The ClickFix-style attack tricked users into pasting a malicious command into Terminal, launching a multi-stage infection chain.
Jamf reported that a later-stage component named stream_module can be fetched on command from the attacker panel. It clones the victim's browser profile, connects to the Chrome DevTools Protocol, and gives attackers hidden live control over logged-in browser sessions.
Jamf Threat Labs discovered and analyzed a macOS infostealer campaign using a fake GitHub page at github.aoitour[.]com and a ClickFix-style lure to get victims to run a malicious Terminal command. The malware, dubbed AmnesiaStealer, steals credentials, keychain data, browser information, Telegram sessions, Apple Notes, and documents.
In its analysis of the macOS infostealer campaign, Huntress linked the loader, payload hosting, and command-and-control infrastructure to the Aeza Group. The group was described as a sanctioned Russian bulletproof hosting provider associated with cybercrime.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
13 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcebleepingcomputer.com
Open sourcescworld.com
Open sourceinfosecurity-magazine.com
Open sourcethehackernews.com
Open sourcejamf.com
Open sourceinfosecurity-magazine.com
Open sourcetheevilbit.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A **ClickFix** social-engineering campaign is targeting macOS users with fake CAPTCHA or verification prompts that instruct victims to copy and paste commands into **Terminal**. The pasted command downloads a malicious `.dmg`, mounts it invisibly, and launches an app or installer that deploys **Atomic macOS Stealer** (`AMOS`). The activity relies on user manipulation rather than a software vulnerability, marking an expansion of ClickFix-style lures onto Apple systems. Once installed, `AMOS` steals browser credentials, cookies, payment data, files, Apple ecosystem data, messaging-app content, and cryptocurrency wallet information from targets including **Safari**, **Apple Notes**, **Apple Keychain**, **Telegram**, **Discord**, and wallet-related browser extensions. Reports say the malware can also show a fake macOS authentication prompt to gain elevated access, archive stolen data into a ZIP file, and exfiltrate it to attacker-controlled servers; in some cases it also replaces legitimate **Ledger Wallet** and **Trezor Suite** applications with trojanized versions to enable further theft.
Jul 30, 2026
Threat actors are escalating **macOS infostealer** activity through multiple distribution and evasion techniques aimed at harvesting sensitive user data. One campaign abuses trust in legitimate AI platforms by promoting shareable *ChatGPT* and *Grok* conversation links via **Google Ads**, luring users searching for common macOS troubleshooting help into running malicious Terminal commands using the **“ClickFix”** social-engineering pattern. Executing the provided shell commands results in installation of **Atomic macOS Stealer (AMOS)**, which steals browser credentials, crypto wallet seed phrases, **Keychain** data, and personal files before exfiltrating them to attacker-controlled infrastructure. Separately, **Odyssey Stealer** intrusions against macOS have surged globally, with notable targeting reported in the U.S., France, and Spain and additional impact across Europe, the Americas, and parts of Asia and Africa. Moonlock Lab reporting indicates Odyssey is delivered through **fake software updates, cracked tools, and fraudulent apps**, and is designed to evade detection by generating a **unique fingerprint per infection**, frequently changing code structure, and using many distinct **SHA-256** variants—suggesting automated builders are being used to produce large numbers of hard-to-block samples. Collectively, the reporting highlights sustained pressure on macOS users from credential-stealing malware that blends high-trust lures with rapid variant generation to hinder traditional defenses.
Jun 29, 2026
Researchers reported a macOS malware campaign distributing an updated **SHub Stealer** variant, dubbed **Reaper**, through fake download pages impersonating trusted software such as WeChat and Miro. The infection chain uses an automated ClickFix-style technique that avoids Terminal paste protections in macOS by opening the built-in **Script Editor** through an `applescript://` link with malicious code already loaded, requiring only a single user action to run. The malware then presents a fake Apple security update prompt to capture the victim’s password while using typo-squatted domains and brand impersonation to make the attack appear legitimate. Once executed, Reaper steals documents, browser credentials from Chrome, Firefox, Brave, Edge, and Opera, along with Keychain and iCloud-related data, Telegram sessions, and cryptocurrency wallet information. It exfiltrates files in chunked ZIP archives to attacker-controlled infrastructure, including via `curl`, modifies legitimate desktop crypto wallet applications to redirect future funds, and establishes persistence through a fake Google Software Update service. Researchers also said the malware checks for a Russian keyboard layout and exits if detected, and noted that this is the third observed automated ClickFix-style macOS campaign in less than two months, indicating the technique is gaining traction among macOS threat actors.
Jun 29, 2026