Security researchers published analysis of a Rust-based macOS infostealer on 13 August 2026. The collection stage is commodity work and two of its bypasses are already patched. An on-demand module clones the victim's browser profile, runs it headless under the Chrome DevTools Protocol, and hands the operator a live screencast with keyboard and mouse. The operator ends up inside an authenticated session, after MFA, while the visible browser stays untouched.

The Chain

Delivery is ClickFix. The staging site github.aoitour[.]com reproduces GitHub's dark theme, Octocat mark and a fabricated "Verified Publisher" badge, then presents a "Terminal installation" panel: open Terminal, paste, press Return, enter your device password. The copied string is Base64-encoded, so the victim sees nothing meaningful before running it. There is no exploit in the initial access. It depends entirely on a human pasting a command and typing their password.

Stage 0, the dropper. A shell script pulls a password-protected ZIP, extracts a binary into /tmp, strips the com.apple.quarantine attribute, applies an ad-hoc signature, launches the payload and deletes itself. The archive password defeats scanners that unpack automatically; quarantine removal plus ad-hoc signing keeps Gatekeeper out of the execution path.

Stage 1, the stealer. A universal Mach-O with an encrypted embedded config. It profiles the host, then raises a native-looking installer prompt to capture the login password, and validates that password with dscl before exfiltrating, so the operator only ever receives credentials that work. On an admin account, that verified password unlocks the privileged commands the rest of the run needs.

Collection covers sixteen Chromium-family browsers (cookies, login data, history, bookmarks, extensions), both Keychains, Safari sessions, Apple Notes, Telegram sessions, and documents from Desktop and Documents. A toggleable clipper watches the clipboard for wallet addresses across nine cryptocurrencies.

Stage 2, stream_module. Fetched only when the operator requests it, so it is absent from the initial infection and from any sandbox nobody drives interactively. It copies the browser profile, launches that copy headless, and attaches over the Chrome DevTools Protocol at roughly 3 fps of screencast with full mouse and keyboard. The profile clone carries session cookies and device-trust state across intact, so the operator lands inside sessions that already cleared MFA, and the victim's own window shows nothing.

Indicators

Two escalation routes in the sample no longer work: CVE-2020-9771, the Catalina-era APFS snapshot mount for Safari cookies, and direct TCC.db injection for Full Disk Access. On macOS 26 the sample fell through to the snapshot method and produced no Safari cookies. Safari data on a patched Mac is out of reach, but the Chromium collection and the Stage 2 hijack are unaffected, because neither needs a bypass once the user hands over the password.

Detection and Response

Initial access leaves little behind by design, so hunt what runs afterwards. The strongest signals are these:

# Stage 2: headless browser under CDP control
SELECT pid, name, cmdline FROM processes
WHERE cmdline LIKE '%--remote-debugging-port%'
OR cmdline LIKE '%--headless%';
# Persistence and captured credential
ls -la /Library/LaunchDaemons/ | grep -i 'com.apple'
ls -la ~/.pwd 2>/dev/null

A Chromium binary spawning with --headless, --remote-debugging-port or a copied --user-data-dir is not normal on a user endpoint, so alert on it rather than only logging it. Apple's own daemons ship inside the signed system volume, so a third-party plist in /Library/LaunchDaemons claiming a com.apple.* label deserves an alert on its own. Also watch for curl or base64 piped into sh, xattr -d com.apple.quarantine and codesign -s - against /tmp, and bulk reads of browser profile directories. Block allllowef[.]space and aoitour[.]com at the resolver.

On a confirmed compromise, every session cookie for that user is attacker-controlled and every Keychain credential is disclosed. Password rotation alone does not close it. Stage 2 works from cloned session state, so invalidate sessions server-side across mail, cloud, banking and admin consoles, and revoke OAuth grants and app passwords. Given a root LaunchDaemon and a self-deleting dropper, erase-and-reinstall beats manual cleanup.

Why It Matters

Stripped of its branding, AmnesiaStealer is another entry in a crowded macOS stealer market, with heavy overlap with Atomic, MacSync and CrashStealer, the same delivery lure, and exploits that died several releases ago.

Stage 2 is the exception, and it is a genuine escalation. A stealer that dumps cookies leaves artifacts a defender can reason about: a set of tokens, a known time of theft, a rotation that closes it. An operator driving a live CDP session inside a cloned profile looks, to every control downstream, like the legitimate user, with the correct device, the correct session, and MFA already satisfied. Fraud logic keyed on impossible travel or unfamiliar devices has nothing to fire on.

The attack also cost very little to build. It needs no zero-day, no Gatekeeper bypass and no signed-binary abuse, only a convincing web page and a user willing to paste a command. Treating "paste this into your terminal" as inherently hostile, in awareness training and in endpoint telemetry, is worth more than any single indicator above.