AmnesiaStealer Malware Gives Attackers Live Control of macOS Browsers and Harvests Credentials
What Happened — A new macOS infostealer, AmnesiaStealer, was uncovered by Jamf Threat Labs. It is distributed via counterfeit GitHub download pages that trick users into running a malicious Terminal command. The payload harvests keychain items, browser cookies, Apple Notes, and then streams a live, hidden browser session to the attacker.
Why It Matters for Compliance & Audit Readiness —
- The attack exploits weak user awareness and lack of controls over executable download sources, a scenario SOC 2 access‑control and security‑awareness policies are designed to mitigate.
- Continuous evidence of security‑awareness training and enforcement of approved‑software baselines provides audit‑ready proof that credential‑theft vectors are being addressed.
- Mapping the incident to SOC 2 CC6.1 (Logical Access) and CC7.1 (Security Awareness) helps demonstrate due diligence in protecting sensitive data.
Who Is Affected — Enterprises and SaaS providers with macOS workstations, especially those handling confidential customer data.
Recommended Actions —
- Review and tighten policies governing software installation from external sources; enforce code‑signing verification.
- Deploy or refresh security‑awareness training that covers social‑engineering tactics such as fake GitHub pages and command‑line lures.
- Implement continuous monitoring for anomalous credential‑access patterns and unauthorized keychain reads. Source: Security Affairs
Technical Notes — The malware uses a three‑stage Rust payload, leverages the “ClickFix” technique on a forged GitHub UI, harvests macOS keychain via dscl and security unlock-keychain, and replaces Chrome’s Safe Storage key to decrypt passwords. Source: Security Affairs