A new malware campaign is targeting Mac users through a particularly persuasive social engineering technique . Researchers at Jamf Threat Labs multi-layered have identified AmnesiaStealer , a infostealer for macOS that leverages fake download pages that mimic GitHub to convince victims to install the malware.
The attack is based on the logic of ClickFix, a method that does not require the victim to download and execute a suspicious file in the traditional way. Instead, the user is instructed to open Terminal, copy a command, and execute it, believing that they are following a normal installation process.
See also: GhostClaw: Malware for macOS via GitHub
The trap is hidden behind a fake GitHub
Attackers have created pages that replicate the look of GitHub, using the platform's dark theme, Octocat feature, and even a "Verified Publisher" label. The goal is to create an environment that appears completely trustworthy and reduce user suspicion.
But instead of initiating a normal app download, the page asks the victim to open Terminal and paste a command. In some cases, the Mac password, which could give attackers even greater power.
Jamf notes that similar fake pages have been used to distribute other infostealers, such as Atomic Stealer and MacSync, indicating that this is a proven attack method.
How AmnesiaStealer is installed
The attack progresses in multiple stages. The command executed by the user first downloads a shell script from the attackers' infrastructure. The script then retrieves a password-protected ZIP file, which contains the main payload.
The installation mechanism includes techniques designed to reduce the chances of detection. The malicious executable is temporarily stored in the /tmp directory, given a name that refers to an Apple file, and attempts to remove the macOS quarantine feature. It is then silently executed and deleted.
The use of encrypted ZIP is also considered a possible attempt to evade automated analysis systems, as it makes it difficult for security tools to directly examine the content.
Keychain and personal data in the spotlight
AmnesiaStealer is designed to collect a wide range of information. Jamf found that it can attempt to steal passwords login through a fake window that mimics a genuine macOS component.
See also: Gaslight: New macOS Malware with Prompt Injection against AI Tools
At the same time, Keychain data , browser information, notes from the Apple Notes app, Telegram session data, and files stored on the computer are targeted
The malware is written in Rust and is distributed as a universal Mach-O file, so it can run on both Intel Macs and Apple Silicon devices. While it attempts to bypass older macOS security measures, researchers have found that many of these attempts fail thanks to Apple patches.
From data theft to remote control
The most worrying element of AmnesiaStealer appears at a later stage of the attack. Upon command from the control and management (C2) server, the malware can download a separate module, known as a “stream_module.”
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The module creates a cloned Chromium profile and communicates with the attacker via WebSocket. In this way, the browser is essentially turned into a remotely controlled environment.
The attacker can open or close tabs, navigate, interact with the keyboard and mouse, and export cookies. The latter capability is particularly important, as a stolen cookie can, under certain conditions, allow the exploitation of an already active and authorized session.
See also: Over 250 ClickFix Domains Hide Malware Baits on macOS
What users should watch out for
The AmnesiaStealer case confirms that a system's greatest weakness may ultimately lie with the user themselves. The instruction "open Terminal and paste this command" should be treated as a serious warning sign, especially when it appears on a website that supposedly offers software.
Organizations are urged to regularly update Macs, implement privilege restriction policies, and monitor endpoints for unusual activity. At the same time, training employees on ClickFix attacks can prevent the initial stage of infection.
The most important message is that malware like AmnesiaStealer is no longer limited to simply stealing passwords. It can turn a Mac into a remote access tool, exposing not only stored data but also active digital sessions.
