[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f29TT5kD4AUgD-023LIpQNZxvg0RS0wV1exVE48jGxpE":3},{"article":4,"iocs":45,"watch_terms":50,"solutions":51,"lesson":136},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"a945e581-0d0e-450d-a501-76a7cddecb5a","AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions","amnesiastealer-macos-malware-steals-data-controls-browser-sessions-cdcfdf","The Rust-based macOS infostealer harvests users’ passwords, keychain information, Chromium-based browser data, and Safari cookies. The post AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions appeared first on SecurityWeek.","A new Rust-based macOS infostealer named AmnesiaStealer is being distributed via a fake GitHub download page. It harvests user credentials, browser data, and can take interactive control of browser sessions using a remote-control module. The malware employs TCC bypasses and targets multiple Chromium-based browsers, potentially rendering saved passwords unrecoverable.","AmnesiaStealer malware for macOS steals passwords, browser data, and controls browser sessions.","https:\u002F\u002Fwww.securityweek.com\u002Famnesiastealer-macos-malware-steals-data-controls-browser-sessions\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F02\u002FMacOS-Mac-malware-Apple.jpeg","2026-08-14T06:41:43+00:00","2026-08-14T08:00:22.621578+00:00",8,[17,20,23,25],{"name":18,"type":19},"macOS","product",{"name":21,"type":22},"Rust","technology",{"name":24,"type":22},"GitHub",{"name":26,"type":22},"Chrome DevTools Protocol","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":27,"icon":29,"name":30,"slug":31},null,"Malware","malware",[33,38,40],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46],{"type":47,"value":48,"context":49},"cve","CVE-2020-9771","Used by AmnesiaStealer to steal Safari cookies and access TCC database.",[18],{"controls":52,"vendors":129},[53,82,100],{"slug":54,"name":55,"problem":56,"products":57},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":83,"name":84,"problem":85,"products":86},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[87,95],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":96,"product_name":97,"url":98,"description":99},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":101,"name":102,"problem":103,"products":104},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[105,113,121],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",[130],{"slug":131,"name":132,"logo_path":133,"roles":134},"apple","Apple","\u002Fvendor-logos\u002Fapple.png",[135],"affected",{"slug":137,"title":138,"body":139,"framework_refs":140,"framework_notes":154},"amnesiastealer-abuses-fake-github-page-to-hijack-macos-browser-sessions","AmnesiaStealer Abuses Fake GitHub Page to Hijack macOS Browser Sessions","AmnesiaStealer demonstrates how threat actors exploit user trust in reputable platforms like GitHub to distribute credential-harvesting malware disguised as legitimate software. By leveraging Transparency, Consent, and Control (TCC) bypasses on macOS, the malware sidesteps built-in privacy protections to access sensitive browser data without triggering standard alerts. The interactive browser session takeover capability is particularly dangerous, as it allows attackers to act in real time on behalf of the victim — bypassing even multi-factor authentication. The potential for saved passwords to become permanently unrecoverable underscores the critical importance of not storing credentials solely within browsers. This campaign illustrates that social engineering via developer-trusted platforms remains a highly effective initial access vector.",[141,142,143,144,145,146,147,148,149,150,151,152,153],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 10: Malware Defenses","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 IA-5: Authenticator Management","NIST CSF DE.CM-1: Network Monitoring","GDPR Article 32: Security of Processing (credential and personal data exposure)","MITRE ATT&CK T1555.003: Credentials from Web Browsers","MITRE ATT&CK T1185: Browser Session Hijacking","MITRE ATT&CK T1553: Subvert Trust Controls (TCC Bypass)",{}]