Reported by 4 outlets

Timeline

1. original reporting

   AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions

   securityweek.com · 60d ago · August 14th, 2026

2. update from gbhackers.com

   AmnesiaStealer Malware Targets macOS Users via ClickFix Attacks

   gbhackers.com · 61d ago · August 14th, 2026

   A newly identified macOS infostealer, named AmnesiaStealer, targets users via ClickFix social-engineering campaigns that impersonate GitHub download pages. This malware combines various malicious features, including password theft, browser data collection, persistence, and the hidden remote control of authenticated Chromium browser sessions. Researchers have observed the campaign using a counterfeit GitHub-themed page that displays a “Download […] The post New AmnesiaStealer Malware Targets macOS Users via ClickFix Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

3. update from cyberpress.org

   AmnesiaStealer macOS Malware Uses ClickFix to Hijack Chromium Browser Sessions

   cyberpress.org · 60d ago · August 14th, 2026

   A newly identified macOS infostealer , dubbed AmnesiaStealer, is using a polished ClickFix campaign to trick users into installing malware that steals credentials and silently commandeers active Chromium browser sessions. Jamf Threat Labs uncovered the operation after investigating a counterfeit GitHub download portal hosted at github.aoitour[.]com. The site closely imitates GitHub’s dark interface, Octocat branding, and “Verified Publisher” badge, giving visitors a convincing impression of legitimacy. Rather than providing a normal application download, the fake page presents a “Terminal installation” section with a one-click copy button. It instructs victims to open Terminal, paste a supplied command, press Return, and enter their macOS password. AmnesiaStealer macOS Malware Uses ClickFix This technique, known as ClickFix , shifts the final execution step to the user, bypassing many conventional warnings because the victim manually launches the malicious command. ClickFix has become increasingly common in macOS-focused social-engineering campaigns . Threat actors have previously used similar lures to distribute malware families, including Atomic Stealer (also known as AMOS) and MacSync. AmnesiaStealer demonstrates how attackers can reuse a familiar phishing template while replacing the backend infrastructure, malware payloads, and post-compromise objectives. Counterfeit GitHub ClickFix Terminal Lure (Source: jamf) After execution, the command launches a concealed shell scri

4. update from bleepingcomputer.com

   AmnesiaStealer macOS malware hijacks browser sessions via remote control

   bleepingcomputer.com · 58d ago · August 16th, 2026

   A new information-stealing malware called AmnesiaStealer, which targets macOS users via ClickFix attacks, includes a streaming module that allows the attacker to interactively control the victim's web browser. A notable capability is copying the victim's Chromium profile, including its authentication state, and loading it into a hidden, headless browser on the infected system. This allows the hacker to access victims' authenticated sessions while preserving the identifiers associated with the browser, host, and network. AmnesiaStealer can collect data in 16 Chromium-based web browsers as well as other sensitive information, such as passwords, cryptocurrency wallets, Apple Notes and documents, and keychain data. The malware is currently distributed through ClickFix campaigns that use a fake GitHub download page to drop a password-protected ZIP archive. Fake GitHub page pushing a ClickFix lure Source: Jamf Researchers at Jamf, an Apple device management and security company, analyzed AmnesiaStealer's distribution and found that it used the same template previously used to spread the Atomic and MacSync infostealers. The ClickFix command executes a shell-script loader that downloads and launches the password-protected archive containing the AmnesiaStealer Mach-O payload.