Jamf Threat Labs has released its analysis of a new, multi-stage macOS infostealer, dubbed “AmnesiaStealer.”
The campaign lures in victims through a counterfeit GitHub page that displays a “Download for macOS” heading. Once downloaded, a silent, self-deleting Rust-based infostealer with macOS-specific capabilities that overlap with the infamous families such as Atomic (AMOS), MacSync, and CrashStealer is deployed.
According to Jamf Threat Labs, this campaign differentiates itself through a builder-driven configuration, OS version-branched logic for patched macOS bypasses, and a second, remote control stage that allows attackers to steal user cookies and evade detection through a stealth script that patches browser fingerprinting application programming interfaces (APIs), avoiding automation flags by the sites it visits.
From the report: AmnesiaStealer sets out to harvest credentials, browser data and live sessions from macOS users, and it delivers on some of that more than the rest. Its Stage 1 payload is an effective collector, capturing the login password through a native prompt and stealing the keychain, Apple Notes and documents, even as several of its macOS bypasses are ones Apple closed years ago, with its own shipped debug strings recording them failing. Its Stage 2 stream module is a capable component in its own right: during our analysis it gave live, hidden control of the victim’s browser and exported cookies in plaintext over the DevTools Protocol. A working collector paired with a working browser-hijack stage, wrapped around a few dated bypasses, makes it worth tracking.
Jamf Threat Labs continues to monitor this activity and track related infrastructure and variants. In Jamf for Mac, customers can configure threat prevention, advanced threat controls and web protection to Block and Report to help prevent the execution of similar threats.
I hope you’ll help support Apple World Today by becoming a patron. Almost all our income is from Patreon support and sponsored posts. Patreon pricing ranges from $2 to $10 a month. Thanks in advance for your support.
Article provided with permission from AppleWorld.Today