Cybersecurity researchers have disclosed details of a new macOS-oriented, Rust-based information stealer called AmnesiaStealer that's capable of hijacking Chromium web browsers to steal session data.
The multi-stage stealer is spread via a counterfeit GitHub download page titled "Download for macOS" and claims to be from a verified publisher. The page employs a ClickFix-style lure that instructs users to copy and paste a Base64-encoded command into the macOS Terminal app.
The attack chain ultimately leads to the deployment of AmnesiaStealer via a dropper script hosted on a remote server, which, according to Jamf Threat Labs, runs in three distinct stages.
"The first is a shell script that downloads and launches the payload," security researcher Thijs Xhaflaire said in a report shared with The Hacker News. "The second is a Rust infostealer that harvests the Keychain, browsers, Apple Notes, and Telegram. The third is a stream_module, fetched on command, that gives the operator hidden, interactive control of the victim's browser."
The script is designed to retrieve a password-protected ZIP archive and delete itself from the host. Extracted from the archive is the first-stage Mach-O binary, a Rust stealer that includes an embedded encrypted configuration that can be modified at the build level through the configuration without making any code changes. It includes the following details -
