New macOS AmnesiaStealer Malware Hijacks Browser Sessions via Remote‑Control ClickFix Campaign
What Happened — Researchers disclosed a macOS‑only infostealer, AmnesiaStealer, delivered through “ClickFix” fake‑GitHub pages. The payload copies Chromium profiles (Chrome, Edge, Brave, etc.) and launches a headless browser that the attacker controls in real time, allowing navigation, clicks, and screen capture of authenticated sessions. It also harvests macOS passwords, keychain entries, Apple Notes, documents, and cryptocurrency wallets.
Why It Matters for Compliance & Audit Readiness
- Demonstrates how compromised credentials can bypass traditional perimeter defenses, highlighting the need for SOC 2‑aligned access‑control policies (CC6.1, CC6.2) and continuous monitoring of privileged activity.
- The remote‑control module creates a covert data‑exfiltration channel that must be logged and evidenced to satisfy SOC 2’s Security principle and to provide audit‑ready proof of detection and response.
- The ClickFix distribution vector underscores the importance of security‑awareness training and documented user‑education controls, a core SOC 2 requirement for mitigating social‑engineering risk.
Who Is Affected – Enterprises with macOS workstations, especially those that rely on Chromium‑based browsers for SaaS applications (tech, finance, professional services, education, etc.).
Recommended Actions
- Enforce MFA and password‑less authentication for all SaaS services accessed via browsers.
- Deploy endpoint‑detection‑and‑response (EDR) with behavior‑based monitoring for unauthorized headless‑browser launches.
- Harden macOS keychain access with strict policy controls and regular credential rotation.
- Conduct security‑awareness training that covers fake‑download (ClickFix) tactics and verification of software sources.
- Map the incident to SOC 2 Access Controls (CC6) and capture evidence of remediation for audit readiness.
Source: BleepingComputer – New AmnesiaStealer macOS malware hijacks browser sessions via remote control
Technical Notes
- Distribution: ClickFix campaign using a counterfeit GitHub page to deliver a password‑protected ZIP containing the Mach‑O payload.
- Attack vector: Social‑engineering download → shell‑script loader → Mach‑O binary.
- Capabilities: Copies Chromium profiles, extracts macOS keychain, Apple Notes, crypto wallets; streams authenticated sessions via WebSocket to attacker‑controlled relay.
- No public CVE; the threat is a novel malware family rather than a product vulnerability.