Executive Answer
Jamf researchers published an analysis on August 16, 2026 of AmnesiaStealer, a macOS infostealer delivered through ClickFix social engineering campaigns. The malware does not steal passwords. It steals authenticated browser sessions by copying the victim's Chromium profile into a hidden headless browser, then giving the attacker live remote control at 3fps via WebSocket. MFA is irrelevant at this point: the user already authenticated. The session is valid. The attacker operates as the user. Enterprise security teams that treat MFA as post-authentication coverage face a gap that session-token-theft malware exploits directly.
- 16 - Chromium-based browsers targeted by AmnesiaStealer for profile and credential exfiltration.
- 7 - Browsers supporting full session duplication for the headless control module: Chrome, Edge, Vivaldi, Arc, Opera, Brave, and Chromium. All share the same DevTools Protocol, launch flags, and cookie encryption.
- 3fps - Live screencast frame rate delivered to the attacker over WebSocket during remote browser control sessions.
- 2 - WebSocket channels used simultaneously: one to the operator's relay for remote control, one to the local headless Chromium instance via the Chrome DevTools Protocol for browser manipulation.
- 0 - Browser exploits required. Delivery is pure social engineering via ClickFix. The user executes the payload themselves by following instructions on a fake page.
- August 16, 2026 - Date of Jamf's published research. The malware is currently in active distribution.
Your authentication controls protect the moment of login. AmnesiaStealer attacks what happens after it.
On August 16, 2026, researchers at Jamf published a detailed technical analysis of AmnesiaStealer, a macOS infostealer being distributed through ClickFix campaigns using fake GitHub download pages. The malware's primary capability is not credential theft in the conventional sense. It copies the victim's authenticated browser sessions and gives an attacker live, interactive remote control over them, without triggering any new authentication event.
The infection chain begins with a ClickFix social engineering lure. A fake GitHub page prompts the user to download software by executing a command in their terminal. The command downloads a password-protected ZIP archive containing the AmnesiaStealer Mach-O binary. The user extracts it with a provided password. The malware executes.
From that point, the attacker has access to more than files and passwords. They have access to the user's identity, as it already exists in every web application the user was logged into.
The Infection Chain
The ClickFix technique that delivers AmnesiaStealer is simple by design. The victim is shown a fake page that looks like a legitimate software download or verification flow. The page instructs them to open their terminal and paste a command. The command is provided. The user pastes it and presses enter.
This social engineering approach is effective because it bypasses automated defenses. The malicious code does not arrive through a browser exploit, a malicious email attachment, or a compromised application. It arrives through user action, explicitly requested by a page the user found credible.
The shell script loader downloads a password-protected ZIP archive from an attacker-controlled server. The fake page provides the password. The victim extracts the archive and obtains the AmnesiaStealer Mach-O binary. Jamf researchers found that AmnesiaStealer uses the same distribution template previously used to deliver the Atomic and MacSync infostealers, suggesting an established infrastructure serving multiple malware families.
After execution, AmnesiaStealer captures the victim's macOS login password through a system prompt, uses it to unlock and copy the macOS Keychain, and begins collecting data from 16 Chromium-based browsers.
What the stream_module Does
The feature that distinguishes AmnesiaStealer from conventional infostealers is its stream_module component. Most macOS infostealers collect data: they exfiltrate files, extract stored credentials, and export saved passwords. AmnesiaStealer's stream_module does something materially different. It turns the infected machine into a live, operator-controlled browser running the victim's authenticated sessions.
The stream_module targets seven Chromium-based browsers that share the same DevTools Protocol, launch flags, and cookie encryption scheme: Chrome, Edge, Vivaldi, Arc, Opera, Brave, and Chromium. For each, the module copies the victim's browser profile to a new location, launches the legitimate browser executable in headless mode with the copied profile, and connects to it using the Chrome DevTools Protocol (CDP).
Simultaneously, the malware establishes a WebSocket connection to the operator's relay server. This channel carries the live screencast at approximately 3fps and transmits JSON status information including tab metadata. A second WebSocket channel connects directly to the headless Chromium instance through its webSocketDebuggerUrl, providing CDP access for browser control.
Through this setup, the operator receives a real-time view of the victim's browser profile as it was at infection time, complete with all active sessions. They can navigate to any website, click any element, scroll, manage tabs, export and import cookies, and interact with any logged-in application. The victim is unaware this is happening. The headless browser instance has no visible window. The legitimate browser the victim uses continues to run normally.
According to Jamf's analysis: "In effect the remote_stream command turns an infected host into a live, operator-driven browser running the victim's authenticated sessions, which is a materially different level of access from file collection."
Why MFA Does Not Protect You Here
The architecture of web authentication creates a structural gap that session-token-theft attacks exploit. When a user completes MFA and logs in successfully, the application issues a session cookie. This cookie represents the authenticated state. On subsequent requests, the browser presents the cookie and the application accepts it as proof of prior authentication. MFA is not re-evaluated on each request.
AmnesiaStealer copies these session cookies as part of the browser profile. When the headless browser launches with the victim's profile, it presents the same session cookies to any web application the victim was authenticated to. From the application's perspective, the requests are indistinguishable from those of the legitimate user. The session is valid. No new authentication event is triggered. MFA does not fire.
This is not a bypass of MFA in the technical sense. The MFA event happened correctly when the user originally authenticated. What session-token theft attacks bypass is the implicit assumption that a valid session token means the legitimate user is still in control of that session.
Organizations that have deployed MFA broadly have correctly addressed the authentication event risk. They have not addressed what happens when an attacker gains access to a machine that holds authenticated sessions. These are separate risk categories, and AmnesiaStealer attacks the second one specifically.
The Enterprise Exposure Surface
AmnesiaStealer targets macOS. Enterprise Mac deployment has grown steadily as organizations adopt Apple hardware for developer, executive, and creative roles. These users frequently authenticate to high-value applications: cloud infrastructure consoles, financial systems, code repositories, HR platforms, email, and SaaS tools that carry privileged access or sensitive data.
The ClickFix delivery mechanism targets developer workflows specifically. Fake GitHub pages are a natural lure for developers who regularly download tools and dependencies from GitHub. A convincing fake download page for a development tool, a security scanner, or a command-line utility is precisely the kind of content a developer might encounter and act on.
Beyond session hijacking, AmnesiaStealer exfiltrates a comprehensive set of data that extends the impact well beyond web application sessions. The macOS Keychain contains stored credentials for system services, VPN configurations, and application passwords. Apple Notes may contain sensitive business information. Telegram sessions may include communications that should not leave the device. Cryptocurrency wallets represent direct financial exposure. All of these are collected and transmitted to attacker-controlled infrastructure.
The combination of session hijacking capability and broad data exfiltration makes AmnesiaStealer a significant enterprise threat, particularly for organizations where developer or executive Mac users have access to privileged systems.
Detection and Response
Add behavioral detection rules for headless browser processes. The stream_module's most distinctive behavior is launching a legitimate browser executable in headless mode from a non-standard directory path. EDR tools should have rules that flag browser processes (chrome, msedge, brave, arc, opera, vivaldi) launched with headless flags from paths outside standard installation directories. This behavior does not occur in normal enterprise usage.
Monitor for remote debugging port usage. When a Chromium-based browser launches with remote debugging enabled (--remote-debugging-port flag), it exposes CDP on a local port. Endpoint monitoring should flag browser processes launching with this flag outside of explicitly approved development tooling contexts. This flag is required for AmnesiaStealer's stream_module to function.
Monitor WebSocket connections from browser processes. Normal browser WebSocket usage connects to application servers. A headless browser process establishing WebSocket connections to external IP addresses not associated with known application domains is anomalous. Network monitoring that correlates browser process WebSocket activity with known-good domain lists can surface this activity.
Flag terminal commands that download and execute code. The ClickFix delivery mechanism involves executing a shell command that downloads a payload. Endpoint monitoring that flags shell commands containing download operations (curl, wget) combined with decompression and execution in a single pipeline can detect ClickFix delivery before the payload runs.
Implement session binding controls for high-value applications. Some enterprise applications support session binding to device identifiers, IP addresses, or client certificates. Session tokens bound to specific device characteristics cannot be reused from a different machine, limiting the value of session token theft. For applications with access to privileged data or infrastructure, assess whether session binding controls are available and enabled.
Consider browser isolation for high-value applications. Browser isolation solutions that run the browser in a controlled environment separate from the user's local machine prevent browser profile copying by design. For applications that carry significant access risk, such as cloud infrastructure consoles and financial systems, browser isolation removes the session token theft vector entirely by ensuring that session data never resides in a browser profile accessible to local processes.
Session-token theft is not a new concept, but the tooling available to attackers for exploiting it has matured significantly. AmnesiaStealer represents a refinement: a malware that packages the full session hijacking capability, delivers it through a reliable social engineering vector, and operates invisibly on the infected machine. What concerns me most from an enterprise security perspective is the MFA gap this exposes. Most organizations have spent the last several years rolling out MFA and are justifiably proud of their coverage numbers. What they have not yet fully grasped is that MFA protects the authentication event. It does not protect the authenticated state that follows it. Session tokens are long-lived, valuable, and in many enterprise environments completely unmonitored. An attacker who copies a session token from a developer's Mac can access cloud infrastructure, code repositories, and production systems without ever triggering an authentication event that MFA would catch. The endpoint is the new identity perimeter. Treat it accordingly.
Related Reading
Does your EDR have behavioral rules that would flag a headless Chromium process launching from a non-standard path on a corporate Mac?
Let's Assess Your Endpoint Detection CoverageSources
- BleepingComputer: "New AmnesiaStealer macOS malware hijacks browser sessions via remote control" (August 16, 2026)
- Jamf Threat Labs: "Amnesia Stealer: macOS infostealer and ClickFix" (August 16, 2026): jamf.com/blog
- Chrome DevTools Protocol documentation: chromedevtools.github.io
Frequently Asked Questions
What is AmnesiaStealer?
A macOS infostealer discovered by Jamf researchers in August 2026. It is delivered through ClickFix social engineering campaigns, copies Chromium browser profiles including session tokens, and gives attackers live remote control over the victim's authenticated browser sessions via WebSocket and Chrome DevTools Protocol. It also exfiltrates Keychain data, Apple Notes, Telegram sessions, and cryptocurrency wallets.
What is a ClickFix attack?
ClickFix is a social engineering technique where a malicious page instructs the victim to paste a shell command into their terminal. No browser exploit is needed. The user executes the payload themselves. AmnesiaStealer uses fake GitHub pages as the lure, presenting a convincing download prompt that instructs users to run a command to complete the installation.
How does browser session hijacking bypass MFA?
MFA protects the authentication event. Once authentication succeeds, the browser holds a session token (cookie) that represents the authenticated state. Session hijacking steals these tokens after authentication has already occurred. The stolen tokens are valid, so the attacker can use them without triggering a new MFA prompt. The authentication event MFA was designed to protect already happened correctly.
How can organizations detect AmnesiaStealer on corporate Macs?
Key detection signals include: browser executables launching with headless flags from non-standard paths; remote debugging port (--remote-debugging-port) usage outside approved development contexts; WebSocket connections from browser processes to external IPs not associated with known applications; and shell commands that download, decompress, and execute in a single pipeline. EDR behavioral rules covering these patterns are the primary detection mechanism.
What is the Chrome DevTools Protocol and how do attackers misuse it?
CDP is a built-in Chromium API that allows programmatic browser control for development and debugging. AmnesiaStealer misuses it by launching the victim's browser in headless mode with remote debugging enabled, then connecting to the CDP endpoint to give the attacker full control: navigation, mouse and keyboard input, cookie management, and live screencasting. This is a legitimate browser feature repurposed as a remote access tool.