The malware performs system reconnaissance and prompts the user for their login password, then uses it to copy login and data-protection keychains while harvesting data from Chromium-based browsers, Apple Notes, and documents.

AmnesiaStealer attempts two TCC bypasses to access Safari cookies and full disk access, then archives harvested data, sends it to a C2 server, and installs a LaunchDaemon to maintain persistence.

A persistence technique deletes and recreates the Chrome Safe Storage key to ensure ongoing attacker access while creating a detectable decryption key for future data.

The infection unfolds in three stages: a shell script fetches and launches the payload, the Rust infostealer harvests data, and a stream module enables interactive control over the victim’s browsers when commanded.

Overall, AmnesiaStealer combines credential harvesting, browser data theft, and live-session hijacking, marking it as a significant macOS threat warranting ongoing detection.

In the final stream stage, it uses the Chrome DevTools Protocol to run a headless browser session and provides a live 3 frames-per-second screencast along with full input control to the attacker via a remote relay.

AmnesiaStealer is distributed as a Rust-based macOS infostealer delivered through a counterfeit GitHub download page using the ClickFix method, spreading across multiple campaigns with shared lure infrastructure.

The stream module exfiltrates cookies via Chrome DevTools Protocol, retrieving plaintext cookies from memory and patching fingerprinting APIs to avoid detection.

Persistence is achieved via a root LaunchDaemon masquerading as Apple’s crash reporting service with a random suffix, designed to survive reboots under the console user’s account.

The malware’s three-stage operation includes a shell-downloaded payload, a Rust infostealer that collects keychain, browser data, Apple Notes, and Telegram, and a stream module for live browser control.

The C2 backend, Amnesia Panel, uses Russian-language login error messages and a consistent URL pattern with per-campaign configurations embedded as XOR-encrypted data, indicating an established operation.

The malware targets six Chromium-based browsers and overwrites per-browser Safe Storage keys in the login keychain with attacker-controlled values, making saved passwords and cookies unrecoverable.