[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAjoD_NT4kmL0SVXWw3PuT2vwoKX4pJFzKAL7CPWBnbs":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":25,"status":26,"created_at":27,"published_at":28,"article":29,"tags":33,"podcasts":52,"controls":53},"82a3725a-75ca-4d2d-9ed3-0f91e99bac0c","amnesiastealer-abuses-fake-github-page-to-hijack-macos-browser-sessions","a945e581-0d0e-450d-a501-76a7cddecb5a","AmnesiaStealer Abuses Fake GitHub Page to Hijack macOS Browser Sessions","AmnesiaStealer demonstrates how threat actors exploit user trust in reputable platforms like GitHub to distribute credential-harvesting malware disguised as legitimate software. By leveraging Transparency, Consent, and Control (TCC) bypasses on macOS, the malware sidesteps built-in privacy protections to access sensitive browser data without triggering standard alerts. The interactive browser session takeover capability is particularly dangerous, as it allows attackers to act in real time on behalf of the victim — bypassing even multi-factor authentication. The potential for saved passwords to become permanently unrecoverable underscores the critical importance of not storing credentials solely within browsers. This campaign illustrates that social engineering via developer-trusted platforms remains a highly effective initial access vector.","**Immediate actions:**\n- Audit and restrict which applications have been granted TCC permissions via System Settings > Privacy & Security on all managed macOS endpoints.\n- Remove or disable the built-in browser password manager and migrate credentials to a dedicated, enterprise-grade password manager.\n- Warn users and publish internal advisories about verifying the authenticity of GitHub download pages before executing any downloaded binaries.\n\n**Long-term improvements:**\n- Enforce application allowlisting (e.g., via MDM\u002FJamf) so only approved, signed binaries can execute on macOS endpoints.\n- Implement a software supply chain verification policy requiring code-signing validation and hash checks for all third-party downloads.\n- Deploy an Endpoint Detection and Response (EDR) solution with macOS-specific behavioral rules to flag Rust-based or unsigned process activity.\n\n**Detection measures:**\n- Monitor and alert on anomalous TCC database modifications or unexpected privacy permission grants using macOS Unified Logging or a SIEM integration.\n- Inspect outbound network traffic for C2 communication patterns indicative of infostealer exfiltration, particularly from browser-adjacent processes.\n- Establish baseline browser process behavior and alert on any child processes or remote-control module injections spawned from Chromium-based browsers.",[12,13,14,15,16,17,18,19,20,21,22,23,24],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 10: Malware Defenses","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 IA-5: Authenticator Management","NIST CSF DE.CM-1: Network Monitoring","GDPR Article 32: Security of Processing (credential and personal data exposure)","MITRE ATT&CK T1555.003: Credentials from Web Browsers","MITRE ATT&CK T1185: Browser Session Hijacking","MITRE ATT&CK T1553: Subvert Trust Controls (TCC Bypass)",{},"published","2026-08-14T08:20:37.415841+00:00","2026-08-14T08:20:37.342+00:00",{"id":7,"url":30,"slug":31,"title":32},"https:\u002F\u002Fwww.securityweek.com\u002Famnesiastealer-macos-malware-steals-data-controls-browser-sessions\u002F","amnesiastealer-macos-malware-steals-data-controls-browser-sessions-cdcfdf","AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions",[34,40,46],{"id":35,"name":36,"slug":37,"description":38,"color":39},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":41,"name":42,"slug":43,"description":44,"color":45},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":47,"name":48,"slug":49,"description":50,"color":51},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[54,58,62],{"slug":55,"name":56,"problem":57},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":59,"name":60,"problem":61},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":63,"name":64,"problem":65},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]