New macOS Infostealer "AmnesiaStealer" Hijacks Browsers via Fake GitHub Pages
Researchers at Jamf Threat Labs have uncovered a sophisticated multi-stage macOS infostealer, dubbed AmnesiaStealer, which tricks users into installing malware through fake GitHub download pages. The attack leverages social engineering, prompting victims to paste a malicious Terminal command under the guise of installing a legitimate application.
How the Attack Works
- Initial Lure – Victims encounter a fake GitHub page mimicking the platform’s dark theme, complete with Octocat branding and a "Verified Publisher" badge. Instead of downloading an app, users are instructed to open Terminal, paste a command, and enter their Mac password.
- Malware Delivery – The command fetches a shell script from attacker-controlled infrastructure, which then downloads a password-protected ZIP containing the malware. The ZIP’s encryption is likely an attempt to evade automated detection.
- Stealthy Execution – The malware deploys a Rust-based Mach-O binary compatible with both Intel and Apple Silicon Macs. It hides in
/tmp, uses an Apple-like filename, removes quarantine flags, and applies a fake code signature to avoid detection. - Data Theft & Browser Hijacking – AmnesiaStealer targets:
- macOS login passwords (via a fake native prompt)
- Keychain credentials
- Browser data, cookies, and session tokens
- Apple Notes, Telegram sessions, and files
- Remote Browser Control – In its third stage, the malware downloads a Rust-based "stream_module" that clones the victim’s browser profile and establishes a WebSocket connection with the attacker. This allows full remote control, including:
- Opening/closing tabs
- Navigating pages
- Scrolling, typing, and mouse interactions
- Exporting cookies in plaintext via DevTools Protocol
Evasion & Persistence Tactics
- The malware attempts older macOS security bypasses, though most fail due to Apple’s patches.
- The password-protected ZIP complicates automated analysis.
- The hidden execution and self-deletion of the binary help evade detection.
Broader Threat Context
Jamf notes that the same fake GitHub template has been used to distribute other macOS stealers, including Atomic. The browser-hijacking module makes AmnesiaStealer particularly dangerous, as it enables attackers to operate with the victim’s authenticated sessions effectively turning the Mac into a remotely controlled endpoint.
Organizations are advised to block the identified indicators of compromise (IOCs) and monitor for suspicious activity matching AmnesiaStealer’s behavior. The malware’s infrastructure, file hashes, and domains have been documented in Jamf’s analysis.
GitHub TPRM report: https://www.rankiteo.com/company/github
"id": "git1786969496",
"linkid": "github",
"type": "Cyber Attack",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'type': 'Individual Users, Organizations'}],
'attack_vector': 'Social Engineering, Fake GitHub Pages, Malicious Terminal '
'Command',
'data_breach': {'data_encryption': 'Password-protected ZIP (malware payload)',
'data_exfiltration': 'Yes',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['macOS login passwords',
'Keychain credentials',
'Browser data (cookies, session '
'tokens)',
'Apple Notes',
'Telegram sessions',
'Files',
'Personally Identifiable '
'Information']},
'description': 'Researchers at Jamf Threat Labs have uncovered a '
'sophisticated multi-stage macOS infostealer, dubbed '
'AmnesiaStealer, which tricks users into installing malware '
'through fake GitHub download pages. The attack leverages '
'social engineering, prompting victims to paste a malicious '
'Terminal command under the guise of installing a legitimate '
'application. The malware steals macOS login passwords, '
'Keychain credentials, browser data, cookies, session tokens, '
'Apple Notes, Telegram sessions, and files. It also '
'establishes remote browser control via a WebSocket '
"connection, allowing attackers to interact with the victim's "
'authenticated sessions.',
'impact': {'data_compromised': 'macOS login passwords, Keychain credentials, '
'browser data (cookies, session tokens), Apple '
'Notes, Telegram sessions, files, personally '
'identifiable information',
'identity_theft_risk': 'High',
'operational_impact': "Remote control of victim's browser, "
'potential unauthorized access to accounts '
'and sensitive data',
'systems_affected': 'macOS (Intel and Apple Silicon)'},
'initial_access_broker': {'entry_point': 'Fake GitHub Pages'},
'investigation_status': 'Ongoing',
'lessons_learned': 'The use of fake GitHub pages and social engineering to '
'trick users into executing malicious Terminal commands '
'highlights the need for heightened user awareness and '
"verification of download sources. The malware's ability "
'to remotely control browsers underscores the importance '
'of monitoring for unusual WebSocket connections and '
'browser activity.',
'motivation': 'Data Theft, Remote Browser Control, Financial Gain',
'post_incident_analysis': {'corrective_actions': 'Block IOCs, enhance '
'monitoring, user education, '
'update macOS',
'root_causes': 'Social engineering, fake GitHub '
'pages, malicious Terminal '
'commands, lack of user awareness'},
'recommendations': ['Block the identified indicators of compromise (IOCs) '
'provided by Jamf Threat Labs',
'Monitor for suspicious activity matching '
"AmnesiaStealer's behavior",
'Educate users on the risks of executing unverified '
'Terminal commands',
'Implement enhanced monitoring for unusual browser '
'activity and WebSocket connections',
'Regularly update macOS to patch known vulnerabilities'],
'references': [{'source': 'Jamf Threat Labs'}],
'response': {'containment_measures': 'Block identified indicators of '
'compromise (IOCs), monitor for '
'suspicious activity',
'enhanced_monitoring': 'Recommended',
'third_party_assistance': 'Jamf Threat Labs'},
'title': "New macOS Infostealer 'AmnesiaStealer' Hijacks Browsers via Fake "
'GitHub Pages',
'type': 'Infostealer'}