A new macOS infostealer called AmnesiaStealer has been spotted spreading through a fake GitHub page that uses ClickFix social engineering to trick users into running a malicious Terminal command. The campaign, first seen in mid‑August, targets Apple computers to harvest passwords, browser cookies and other sensitive data. Jamf Threat Labs published a breakdown of the activity, which is available at their blog.
The infection starts when the user pastes a command into Terminal that downloads and executes a shell script. This script launches a multi‑stage chain: it drops a payload, creates a LaunchDaemon for persistence and mutes the system sound to avoid auditory alerts. AmnesiaStealer then steals credentials and cookies from Chromium‑based browsers, overwriting the stored values so they cannot be recovered, and also exploits an older vulnerability to exfiltrate Safari cookies.
The malware features a builder‑driven configuration that lets threat actors adjust capabilities on the fly, and it provides an interactive remote‑control channel that lets attackers manipulate the victim’s browser session in real time. No CVEs have been linked to the code itself; instead it relies on legitimate macOS mechanisms and an older Safari flaw to stay hidden. Researchers have noted the use of Russian‑language artefacts in the infrastructure, although no specific group has been attributed.
Activity was observed between 14 August and 19 August 2026, indicating the malware is already in the wild. The lure imitates a legitimate GitHub repository, presenting a fake download page that convinces victims to execute the supplied command. This ClickFix technique bypasses many traditional defences because it relies on user action rather than exploiting a software vulnerability. Securityweek and Infosecurity Magazine have also covered the campaign, with articles available at SecurityWeek and Infosecurity Magazine.
Defenders should watch for atypical Terminal usage, especially commands that invoke curl or sh to fetch code from unknown domains. Enforcing execution policies that block unsigned or untrusted scripts can stop the initial dropper. Auditing LaunchDaemon and LaunchAgent property‑list files for unfamiliar entries helps detect the persistence mechanism. Monitoring for sudden alterations to browser data files, such as the Cookies or Web Data SQLite databases, can reveal credential‑harvesting activity. Educating users to verify URLs and to refuse running code from unverified pages remains a core line of defence.
Endpoint detection and response tools should be tuned to flag processes that mute audio or attempt to hide their output, as these behaviours are characteristic of the stealer’s evasion tactics. Blocking network traffic to the domains used for the fake GitHub site limits the attacker’s ability to retrieve additional payloads. Keeping macOS up to date mitigates the older Safari flaw that the malware abuses for cookie theft. Regular backups of keychains and browser profiles, stored offline and tested for integrity, ensure that stolen data can be restored if an infection occurs.
Staying vigilant against social engineering that pretends to be trusted developer platforms reduces the chance of a successful ClickFix attack. Applying least‑privilege principles, limiting admin rights and reviewing authorisations regularly limits what malware can do once it runs. Conducting periodic threat hunts that look for signs of credential scraping, unusual LaunchDaemon creation or silent script execution helps catch infections before they cause significant harm. Sharing indicators of compromise with peers and industry groups strengthens collective defence against this evolving threat.