A new threat has emerged for macOS users in the form of **AmnesiaStealer**, an information-stealing malware leveraging **ClickFix** attacks. A critical feature of **AmnesiaStealer** is its ability to copy a victim's **Chromium** profile, including its authentication state, and load it into a hidden, headless browser on the infected system. This grants attackers access to authenticated sessions while preserving crucial browser, host, and network identifiers. **AmnesiaStealer** is capable of collecting data from 16 **Chromium**-based web browsers. Beyond browser data, it targets other sensitive information such as passwords, cryptocurrency wallets, **Apple Notes** and documents, and keychain data. ### Distribution Method: Deceptive ClickFix Campaigns The malware is currently disseminated through **ClickFix** campaigns. These campaigns typically involve a fake **GitHub** download page that lures users into downloading a password-protected ZIP archive.  Researchers at **Jamf**, an **Apple** device management and security company, have analyzed **AmnesiaStealer**'s distribution. They found that it utilizes the same template previously employed to spread the **Atomic** and **MacSync** infostealers. Upon execution, the **ClickFix** command initiates a shell-script loader. This script downloads and launches the password-protected archive, which contains the **AmnesiaStealer Mach-O** payload. The malware then proceeds to capture the victim’s macOS password, using it to collect keychain data, browser profiles, **Apple Notes**, **Telegram** sessions, documents, system information, and cryptocurrency wallet data.  ### The 'Stream_Module': Live Session Hijacking A key component highlighted by researchers is the malware's `stream_module`, retrieved via the `remote_stream` command. This module provides the malicious operator with remote control over authenticated sessions deployed from a headless browser instance. According to **Jamf**, **AmnesiaStealer**'s `stream_module` can duplicate user profiles across seven **Chromium**-based browsers: **Google Chrome**, **Microsoft Edge**, **Vivaldi**, **Arc**, **Opera**, **Brave**, and **Chromium** itself. This broad compatibility stems from their shared **DevTools Protocol**, launch flags, and cookie encryption methods. The module operates by launching the legitimate browser executable in headless mode, employing command-line switches that weaken browser defenses. It then duplicates the victim’s profile and specifies its location for storing the profile data. ### Two-Channel WebSocket Communication The malware establishes a **WebSocket** channel to connect to the operator's relay, sending a **JSON** registration message with the browser name and build. Through this channel, the operator can issue commands like navigation and mouse clicks, while the malware provides status and tab information in **JSON** and transmits screencast frames as binary **WebSocket** messages. A second **WebSocket** channel connects to the local headless **Chromium** instance via the browser’s `webSocketDebuggerUrl`, granting access to the **Chrome DevTools Protocol (CDP)**. This allows the attacker to navigate websites, control mouse and keyboard inputs, export or import cookies, and operate online portals using the victim’s existing authenticated sessions. "The operator receives a live screencast of the session at around 3fps and can drive it with a full input set: keyboard, mouse, scroll, navigation and tab management," **Jamf** explains. "In effect the remote_stream command turns an infected host into a live, operator-driven browser running the victim's authenticated sessions, which is a materially different level of access from file collection."  ### Data Exfiltration and Persistence **AmnesiaStealer** can exfiltrate cookies, saved logins, browsing history, bookmarks, extensions, local state, and other profile data from the 16 targeted **Chromium**-based browsers. It also steals cryptocurrency wallet details by enumerating extensions and **IndexedDB** data. **Jamf** notes a fallback mechanism for macOS 26, where if the existing **Chrome Safe Storage** key cannot be recovered, it is replaced with an attacker-supplied value. This renders previously stored cookies and passwords permanently unreadable while allowing the attacker to decrypt data later. ### CDP Abuse: A Growing Trend The **Chrome DevTools Protocol (CDP)** has been previously exploited by malware, including **Chaos ransomware** to obscure command-and-control communications and **Chaes malware** to expose browser functions for data theft. However, **AmnesiaStealer** marks the first documented macOS malware to combine a cloned **Chromium** profile with **CDP**-based, live remote control, providing attackers with unprecedented interactive access to authenticated sessions through a hidden browser on the infected machine. Users are strongly advised against executing unfamiliar commands found online in their terminal.