A new macOS-focused malware campaign is drawing attention for its ability to interfere with browser sessions in Chromium-based apps such as Google Chrome and Microsoft Edge. The threat, known as AmnesiaStealer, is designed to collect sensitive browser data and can extend its reach across multiple installed browsers.
Security researchers at Jamf report that the malware is being distributed through a password-protected ZIP file hosted on a fake GitHub-style page. In the observed attack flow, users are encouraged to run a Terminal command that downloads and installs the payload, giving the malware access to browser profiles and stored information.
Once active, AmnesiaStealer can retrieve saved logins, cookies, browsing history, bookmarks, extensions, and even cryptocurrency wallet data. It may also access macOS password information, keychain content, Apple Notes, Telegram sessions, documents, and system details, making browser hygiene and command-line caution especially important.
The campaign follows a familiar ClickFix pattern, where social engineering is used to make malicious commands appear routine or helpful. Security experts recommend avoiding commands from unofficial sources, being cautious with fake verification labels, and treating unexpected prompts or installation steps with skepticism.
As browser use becomes more central to work and daily life, stronger user awareness and safer execution habits may help shape a more resilient digital future.
