Stealthy New macOS Malware 'AmnesiaStealer' Grants Attackers Real-Time Control Over Web Browsers

A sophisticated new strain of information-stealing malware targeting macOS users has been discovered, raising fresh alarms over the security of Apple's desktop operating system. Dubbed "AmnesiaStealer," the malicious software stands out from typical infostealers by incorporating a live streaming module. This advanced feature allows remote attackers to actively monitor and interactively control a victim's web browser in real-time, escalating the potential damage of a standard data-theft incident.

According to security researchers, the malware is primarily distributed through what are known as "ClickFix" social engineering campaigns. These attacks trick unsuspecting users by displaying highly convincing, fake error messages on compromised or malicious websites. Visitors are prompted to follow instructions to "fix" their browser or install a critical update, which ultimately leads to the execution of malicious commands that download and install AmnesiaStealer onto the host system.

While traditional info-stealing malware typically harvests saved credentials, autofill data, and cookies to transmit back to a command-and-control server, AmnesiaStealer's interactive streaming capabilities represent a dangerous evolution. By taking remote control of an active browser session, attackers can easily bypass advanced security measures like multi-factor authentication (MFA). Since the user is already logged in, the threat actors can navigate sensitive accounts, initiate unauthorized transactions, or steal proprietary data directly through the hijacked interface.

The emergence of AmnesiaStealer highlights a broader trend of cybercriminals increasingly focusing their efforts on Apple's ecosystem. Historically, macOS was perceived as a relatively safe haven compared to Windows, but the rapid proliferation of macOS-specific infostealers over the past year has challenged this assumption. Cybercriminals are dedicating more resources to developing specialized payloads designed to bypass built-in macOS security features like Gatekeeper.

To protect against AmnesiaStealer and similar threats, security experts recommend that users exercise extreme caution when encountering unexpected prompts on websites claiming their browser is broken or needs an immediate update. Legitimate web browsers handle updates automatically or through official settings menus, rather than demanding users copy and paste commands into their system terminal. Keeping operating systems and security software updated remains a critical line of defense against these evolving threats.