New macOS malware turns stolen browsers into attacker-controlled sessions
Brief
Mac users are being freshly warned of suspicious websites asking them to open Terminal and install software. Jamf Threat Labs has uncovered a multi-stage macOS infostealer, dubbed AmnesiaStealer, that uses a ClickFix-style fake GitHub download page to trick victims into executing a command that installs malware.
The campaign is designed to steal credentials and sensitive data before escalating into silent, interactive control of the victim’s Chromium browser, Jamf researchers said in a blog post. The attack was found mimicking GitHub’s dark theme, Octocat branding and a “Verified Publisher” badge.
Instead of providing an application, as promised in the lure, the page tells users to open Terminal, paste a command and enter their Mac password. According to Jamf, the same fake download template has been used to distribute other macOS stealers including Atomic (AMOS) and MacSync.