New AmnesiaStealer macOS malware hijacks browser sessions via remote control

AmnesiaStealer is a macOS-targeting information-stealing malware distributed via ClickFix campaigns using fake GitHub download pages. It steals browser profiles, passwords, cryptocurrency wallets, Apple Notes, keychain data, and documents. A key capability is its 'stream_module' component, which enables remote operators to control a headless browser instance loaded with the victim's cloned Chromium profile, allowing interactive access to authenticated web sessions via WebSocket-based remote control. This provides attackers with live screencast access and full input control (keyboard, mouse) over the victim's active sessions.

AI-extracted · verify before operational use