New AmnesiaStealer macOS malware hijacks browser sessions via remote control

A new security threat identified as AmnesiaStealer is targeting macOS users by hijacking browser sessions. According to reports from BleepingComputer, the malware grants attackers remote control over browser sessions on infected systems. The infection process begins when users engage with fake GitHub downloads, which then turn web browsers such as Safari and Google Chrome into tools for stealing sensitive Keychain data. This mechanism allows the attackers to maintain live control over the user's browsing activity rather than simply stealing static files. Multiple cybersecurity outlets are tracking the development of this threat.

BleepingComputer, thehackernews.com, and CSO Online emphasize the malware's ability to turn stolen browsers into attacker-controlled sessions. TechRepublic further highlights that the malware allows attackers to control browser sessions specifically after the initial infection has occurred. Meanwhile, AppleInsider focuses on the delivery method, noting that the fake GitHub downloads are the primary vector used to compromise Safari and Chrome to access the system's Keychain data. This trend is significant because it shifts the focus from traditional data exfiltration to active session hijacking on the macOS platform. By leveraging the trust associated with GitHub downloads, the attackers can bypass user caution to install AmnesiaStealer.

Once the malware is active, the ability to hijack Chromium-based sessions and Safari provides the attackers with a direct window into the user's authenticated accounts and stored credentials within the Apple Keychain, increasing the potential for unauthorized access to private accounts. Future monitoring will likely focus on the distribution points of these fake GitHub downloads and the specific technical methods AmnesiaStealer uses to maintain remote control. Based on the coverage from the five reporting outlets, the primary areas of concern remain the vulnerability of Chrome and Safari sessions and the continued risk of social engineering via trusted developer platforms. Users are currently warned about the risks associated with downloads that masquerade as legitimate GitHub projects to avoid Keychain compromise.