The Browser Session Wasn’t Stolen. The Attacker Drove It From Inside the Mac.
AmnesiaStealer does more than copy cookies from an infected Mac. Its second act clones the browser’s authenticated state, launches the copy in a hidden process and lets an operator use the victim’s sessions in real time.
Most browser-session theft is described as a transfer. Malware steals a cookie or token, sends it to an attacker and the attacker attempts to replay it somewhere else.
Research published by Jamf Threat Labs on 13 August describes a more interactive model. AmnesiaStealer is a multi-stage, Rust-based macOS infostealer observed in the wild. Alongside conventional theft, it can create a hidden clone of a victim’s Chromium browser profile and expose that clone to a remote operator.
The browser session is not simply stolen. It is driven from inside the compromised Mac.
It starts with a fake GitHub download
The infection chain begins with a counterfeit GitHub “Download for macOS” page. The page uses a ClickFix-style lure, instructing the victim to copy a command into Terminal. The pasted shell command decodes and executes the next stage.
This avoids relying on a browser exploit. The victim is persuaded to cross the operating system’s execution boundary manually.
The main stealer then presents a native-looking installer prompt for the Mac login password and validates it locally. With that access, it targets familiar high-value data: the macOS Keychain, browser data, Apple Notes, Telegram information and selected documents.
Jamf notes that several dated bypass techniques in the sample fail on macOS 26. That does not make the campaign harmless. The researchers found a working data collector and a working browser-hijack module, even where some supporting tricks had aged badly.
The hidden browser changes the risk
On command, AmnesiaStealer retrieves a component called stream_module. It supports seven Chromium-based browsers: Chrome, Brave, Edge, Arc, Opera, Vivaldi and Chromium.
The module copies authenticated browser-profile data into a hidden directory under ~/.local/share/.stream/profiles/. It launches a headless browser against the cloned profile and controls it through the Chrome DevTools Protocol. The victim’s visible browser can remain open and apparently normal.
From the operator’s perspective, this is valuable for two reasons. The malware can export cookies in plaintext through the DevTools interface, and the operator can navigate a browser that is already running on the trusted endpoint with the victim’s local session state.
That can weaken controls built around token replay. A service may challenge a cookie used from a new country, cloud host or browser fingerprint. A hidden browser running on the victim’s Mac inherits far more of the expected environment.
Session security is endpoint security
Phishing-resistant authentication protects the sign-in ceremony. It does not make an authenticated endpoint trustworthy forever.
A passkey can stop an attacker from logging in with a captured password. It cannot stop malware that acts after the legitimate user has authenticated. The same is true of many conditional-access checks. If the hostile activity comes from the enrolled device, using its browser state and network path, risk signals may be less obvious.
This is the connection between AmnesiaStealer and recent attacks that turn a Mac into the attacker’s interface. In both cases, the endpoint is not only a source of secrets. It becomes an operating environment.
Identity teams and endpoint teams cannot solve that problem separately. The identity platform sees a valid session. The endpoint platform must determine whether the process using it is legitimate.
What defenders should look for
- ClickFix behaviour. Treat websites that ask users to paste commands into Terminal as a high-confidence social-engineering signal.
- Unexpected shell and installer activity. Correlate browser visits with shell execution, downloads, password prompts and binaries launched from user-writable locations.
- Hidden profile copies. Monitor for the
.streamdirectory and unusual bulk access to Chromium profile databases. - Headless browser processes. Look for browsers launched with remote-debugging options or profiles outside their normal paths.
- Chrome DevTools Protocol use. Local debugging interfaces are useful for developers and attractive to malware. Baseline legitimate use and investigate anomalies.
- Post-compromise identity response. Isolate the Mac, revoke active sessions, rotate exposed credentials and review account activity. Password reset alone is not enough.
The user’s browser is now an attack surface
Security architecture often treats the browser as a neutral window into protected services. AmnesiaStealer shows why that model is incomplete. The browser holds durable authentication state, exposes automation interfaces and runs on an endpoint that may already be hostile.
Defenders should continue moving towards passkeys and phishing-resistant MFA. They should also assume that successful authentication creates a new asset that needs protection: the live session itself.
When malware can clone and operate that session locally, identity defence has to continue after login.
