GoKawiilA new information-stealing malware called AmnesiaStealer, which targets macOS users via ClickFix attacks, includes a streaming module that allows the attacker to interactively control the victim's web browser.
A notable capability is copying the victim's Chromium profile, including its authentication state, and loading it into a hidden, headless browser on the infected system.
This allows the hacker to access victims' authenticated sessions while preserving the identifiers associated with the browser, host, and network.
AmnesiaStealer can collect data in 16 Chromium-based web browsers as well as other sensitive information, such as passwords, cryptocurrency wallets, Apple Notes and documents, and keychain data.
The malware is currently distributed through ClickFix campaigns that use a fake GitHub download page to drop a password-protected ZIP archive.
Fake GitHub page pushing a ClickFix lure
Source: Jamf
Researchers at Jamf, an Apple device management and security company, analyzed AmnesiaStealer's distribution and found that it used the same template previously used to spread the Atomic and MacSync infostealers.
The ClickFix command executes a shell-script loader that downloads and launches the password-protected archive containing the AmnesiaStealer Mach-O payload.
The malware captures the victim’s macOS password and uses it to collect keychain data, as well as browser profiles, Apple Notes, Telegram sessions, documents, system information, and cryptocurrency wallet data.
... continue reading