The attack on your Mac starts with a command you paste into Terminal yourself. 

Jamf Threat Labs has documented AmnesiaStealer, a multi-stage Rust-based macOS infostealer distributed through ClickFix. A counterfeit GitHub page, complete with the dark theme and Octocat branding, offers a “Download for macOS” button. The instructions tell you to paste a command into Terminal. You do. That is the infection. 

The Delivery Chain 

The pasted command runs a shell script that downloads a password-protected ZIP archive and launches a Mach-O payload. The victim installs the malware on themselves, which is the entire point of ClickFix: the user is the delivery mechanism. 

I have written about this lure family before, and macOS is now squarely in its crosshairs. 

What It Collects 

Stage One is a conventional but effective collector. It prompts for the login password with a native-looking alert and validates it using dscl, so a wrong guess fails silently, and the user is none the wiser. It unlocks and copies login and data-protection keychains, then collects data from 16 Chromium browsers, Apple Notes, Telegram, documents, and crypto wallets. It attempts two TCC bypasses and installs a LaunchDaemon for persistence. 

That alone is a full credential and document harvest. The stage two component is what makes AmnesiaStealer different. 

The New Trick: Live Browser Control 

On the remote stream command, the malware clones the victim’s Chromium profile, launches a real browser instance headless with hardening flags off, and hands the operator live control over WebSocket and CDP. The operator sees a screencast and can navigate, click, type, and export cookies. The victim’s authenticated sessions, email, corporate portals, cloud consoles, financial accounts, are simply being operated by someone else at about three frames per second. 

This is the first documented macOS malware to combine a cloned browser profile with live CDP remote control. It is not an automated credential dump. It is interactive access that preserves the victim’s browser, host, and network identifiers. 

What This Should Change 

If a Mac is infected with AmnesiaStealer, treat its authenticated sessions as actively observed, not merely drained. Rotate credentials, invalidate active sessions, and reset browser sync across every account used on the host. 

And educate your macOS users on the one rule that breaks the chain: no legitimate software is installed by pasting a command into Terminal from a web page. 

AmnesiaStealer is the first macOS infostealer that stops copying data and starts using the victim’s own browser live, which means compromised Macs should be treated as having their authenticated sessions actively observed, not merely drained.