The recent discovery of AmnesiaStealer, a sophisticated macOS-oriented information stealer, has raised concerns among cybersecurity experts. This Rust-based malware is designed to hijack Chromium web browsers, stealing session data and providing attackers with unprecedented control over the victim's browser. The attack chain begins with a deceptive GitHub download page, luring users into executing a Base64-encoded command in the macOS Terminal. This leads to the deployment of AmnesiaStealer through a multi-stage dropper script hosted on a remote server.
One of the most alarming aspects of AmnesiaStealer is its ability to retrieve a password-protected ZIP archive and delete itself from the host. Inside the archive lies a Mach-O binary, a Rust stealer with an embedded encrypted configuration. This configuration allows for command-and-control (C2) endpoints and the enablement or disablement of a clipboard-hijacking module, targeting various cryptocurrencies. The malware also performs host reconnaissance, geolocation profiling, and captures the system password under the guise of an installer.
What sets AmnesiaStealer apart from other stealers is its builder-driven configuration, operating system version-branched logic, and a remote-control second stage. The malware targets 16 Chromium-family browsers, gathering cookies, login data, and other sensitive information. It reads Chrome Safe Storage passwords and steals cookies from Safari, exploiting vulnerabilities in macOS versions. AmnesiaStealer also establishes persistence through a root LaunchDaemon, impersonating Apple's crash reporting service.
The most concerning feature, however, is the remote-control capability. The malware enables interactive remote control over the Chrome DevTools Protocol, allowing attackers to steal user cookies and evade detection. This hands-on-keyboard control provides a live screencast of the session, giving the operator full input set control over the victim's browser. The malware's stealth script patches browser fingerprinting APIs to avoid detection.
In my opinion, the discovery of AmnesiaStealer highlights the evolving nature of cyber threats. As malware becomes more sophisticated, it's crucial for cybersecurity researchers and users to stay vigilant. The attack chain, from deceptive download pages to remote control capabilities, showcases the need for robust security measures and user awareness. It's a constant arms race, and we must adapt to protect ourselves from these ever-evolving threats.
