AmnesiaStealer Malware Uses Fake GitHub Pages to Hijack macOS Browser Sessions

Jamf Threat Labs has identified AmnesiaStealer, a multi-stage Rust-based infostealer targeting macOS users, published in a report dated August 13, 2026. The malware spreads through a fake GitHub ClickFix page that tricks users into pasting a Terminal command, which downloads and executes a malicious shell script. Once installed, it steals login passwords, Keychain data, Apple Notes, Telegram content, Chromium browser profiles, and cryptocurrency wallet information, sending it all to a remote command-and-control server. A secondary module called stream_module uses Chrome DevTools Protocol to silently take over live browser sessions, enabling remote control of tabs, cookies, mouse, and keyboard input. The malware also attempts to establish persistence by creating a root LaunchDaemon, though its exploit of CVE-2020-9771 for TCC bypass was found to fail on current macOS 26 without Full Disk Access.