AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions

AmnesiaStealer demonstrates how threat actors exploit user trust in reputable platforms like GitHub to distribute credential-harvesting malware disguised as legitimate software. By leveraging Transparency, Consent, and Control (TCC) bypasses on macOS, the malware sidesteps built-in privacy protections to access sensitive browser data without triggering standard alerts. The interactive browser session takeover capability is particularly dangerous, as it allows attackers to act in real time on behalf of the victim — bypassing even multi-factor authentication. The potential for saved passwords to become permanently unrecoverable underscores the critical importance of not storing credentials solely within browsers. This campaign illustrates that social engineering via developer-trusted platforms remains a highly effective initial access vector.