A new strain of malware dubbed “AmnesiaStealer” is actively compromising macOS systems, using fake GitHub repositories to harvest sensitive browser data. Security researchers identified the threat this week, noting that attackers are leveraging malicious landing pages to trick developers and casual users into downloading high-risk payloads disguised as legitimate software tools.
The attack chain begins with search engine manipulation. Attackers create GitHub pages that mirror popular open-source projects, complete with convincing documentation and “Download” buttons. Once a user triggers the download, the malware executes a script designed to bypass macOS Gatekeeper protections.
“The sophistication lies in how it mimics the development workflow,” said a lead analyst at a prominent cybersecurity firm tracking the campaign. “Users expect to download binaries from GitHub, so the social engineering barrier is exceptionally low.”
Once inside the system, AmnesiaStealer targets browser configuration files and keychain data. It systematically scrapes saved passwords, cookies, and session tokens from Chrome, Brave, and Firefox. By exfiltrating these session cookies, the attackers can effectively hijack active logins, bypassing multi-factor authentication (MFA) on platforms ranging from personal social media accounts to corporate cloud environments.
The malware’s persistence mechanism is equally aggressive. It installs a launch agent in the user’s Library folder, ensuring it runs every time the system boots. This allows the threat actor to maintain a persistent connection to the infected machine, even if the user attempts to restart or clear their browser cache.
Apple’s security team has been notified, but the decentralized nature of GitHub repositories makes it difficult to neutralize the threat entirely. Attackers simply rotate to new domains as soon as one is flagged.
For now, the defense is manual. Security experts advise users to verify the repository owner’s history and commit logs before running any script or executable found on GitHub. If a download prompts an unexpected “Terminal” window or asks for administrative passwords without a clear reason, the process should be terminated immediately.
The risk is not just a lost password; it’s the potential for total account takeover. With session cookies in hand, the barrier between a user’s private data and the attacker’s command-and-control server has effectively vanished.
