AmnesiaStealer Targets macOS Chromium Browsers via Counterfeit GitHub Pages

According to a report by The Hacker News, cybersecurity researchers have disclosed details of AmnesiaStealer, a macOS-focused information stealer developed in Rust. The malware targets Chromium-based web browsers, aiming to steal session data and potentially provide attackers with live browser control.

The attack chain begins with a counterfeit GitHub download page titled "Download for macOS," which claims to be from a verified publisher. The page utilizes a ClickFix-style lure to persuade users into executing malicious code. Once executed, the multi-stage stealer operates on the macOS platform, specifically targeting Chromium browsers installed on the system.

The primary objective of AmnesiaStealer is the exfiltration of sensitive information, particularly browser session data. By targeting Chromium-based browsers, the malware can access stored cookies, autofill data, and potentially active sessions, allowing attackers to impersonate users or gain unauthorized access to accounts.

As of the report date, no specific software patches have been issued by browser vendors to address AmnesiaStealer. The mitigation strategy focuses on user awareness and operational security: avoiding the download of software from unverified or counterfeit GitHub pages, maintaining up-to-date macOS security settings, and exercising caution with unexpected download prompts.