The page looks like GitHub, down to the dark theme and a badge that says the publisher is verified. Where a download button would normally be, it offers Mac users a command to paste into Terminal. Anyone who follows the instructions installs AmnesiaStealer, a new piece of macOS malware that does more than empty the usual stores of passwords and cookies. It can also hand its operator a live, hidden copy of the victim's browser, already signed in to everything.
Researchers at Jamf Threat Labs described the malware this week after finding it in real attacks. They named it after the Amnesia Panel, the control server it reports to. The fake download page is not unique to this family. Jamf says the same template has been used to spread the Atomic and MacSync stealers, so the lure is evidently shared between several criminal operations.
Three stages, one password
The pasted command fetches a short shell script, which downloads an archive protected with a password and launches the program inside it. That program is written in Rust, and its first act is to put up a system style prompt asking for the Mac's login password, dressed up as part of an installer. It checks each attempt on the machine itself and keeps asking until the right password is entered.
Everything else depends on that password. Once the stealer has it, the login keychain is opened and Apple Notes is read. The Desktop, Documents and Downloads folders are searched for documents and cryptocurrency wallet files. It collects cookies, saved logins, history and extension data from 16 browsers built on Chromium, and it takes Telegram session data too. To make sure it survives a restart, it installs itself as a system service with a name chosen to look like Apple's crash reporter.
Jamf noticed one habit that defenders can use. On macOS 26, when the malware cannot read the key Chrome uses to encrypt its stored secrets, it deletes that key and writes in one of its own. The attacker can then decrypt whatever the browser saves from that point on, while the data saved earlier becomes unreadable. Legitimate software has no reason to delete and recreate that entry, so the action stands out in logs.
A second browser the victim never sees
The third stage is downloaded only when the operator asks for it. It copies the victim's browser profile, starts the real browser in headless mode with that copy, and connects it to the attacker over a relay. The operator then gets a screencast of the session at about three frames per second and can type, click, scroll, open tabs and move between pages, all while the window on the victim's screen shows nothing unusual. Jamf says this works with seven browsers, among them Chrome, Edge, Brave, Opera, Vivaldi and Arc.
This is a different kind of access from stolen cookies. Banks, mail providers and corporate portals increasingly check whether a session is coming from the device and network they expect, and a cookie replayed from a server in another country can trip those checks. Here the requests come from the victim's own Mac, through the victim's own browser build and internet connection. There is very little for the service on the other end to notice.
The hidden browser also gives up its cookies without any decryption work. The module simply asks the running browser for them through the same debugging interface developers use, and the browser returns them in plain text because it has already decrypted them in memory.
Not all of it is new or well made. The malware tries several tricks for getting around macOS protections that Apple fixed some time ago, and Jamf's assessment is that parts of it work better than others. The panel returns its error messages in Russian, and the way builds are generated suggests a builder that produces a separate configuration for each campaign.
The infection still starts with a person pasting a command from a web page into Terminal and typing their password when asked. A page that offers that in place of a normal download deserves suspicion, however official it looks.
