[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqEWC14l5_ar9fPSY5vov9DzZB2BDFZZ74wXsYsfWLJs":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":57},"bb4174fc-6ca0-4f1a-a8dd-21f8543fa72b","amnesiastealer-hijacks-macos-browser-sessions-via-fake-github-pages","fed2bab4-8e7e-44ac-8366-8bb2c9459eaa","AmnesiaStealer Hijacks macOS Browser Sessions via Fake GitHub Pages","AmnesiaStealer exploits users' trust in platforms like GitHub by distributing malware through convincing fake download pages, highlighting a critical gap in security awareness among macOS users who often assume their platform is inherently safe. Once installed, the malware's streaming module grants attackers real-time remote control over browser sessions, meaning stolen authenticated sessions can bypass multi-factor authentication entirely. The theft of browser profiles, session cookies, and cryptocurrency wallets represents a severe data protection failure with potentially irreversible financial and privacy consequences. This attack underscores that social engineering combined with advanced session hijacking techniques can render traditional credential-based defenses ineffective.","**Immediate actions:**\n- Verify all software downloads by checking the official vendor website directly rather than clicking links from search results or social media.\n- Audit and revoke any active browser sessions on sensitive accounts (email, banking, crypto) if macOS malware exposure is suspected.\n- Enable macOS Gatekeeper and enforce App Store or notarized-app-only installation policies across managed devices.\n\n**Long-term improvements:**\n- Deploy endpoint detection and response (EDR) solutions on all macOS devices to detect anomalous browser process behavior and remote control activity.\n- Implement hardware-bound authentication (e.g., FIDO2\u002Fpasskeys) so that stolen session cookies cannot be replayed by attackers.\n- Establish a formal software allowlisting policy that prevents execution of unauthorized binaries downloaded from the internet.\n\n**Detection measures:**\n- Monitor for unusual browser profile directory access or copying activity using file integrity monitoring tools.\n- Set up alerts for outbound connections from browser processes to unexpected external IP addresses or domains.\n- Conduct regular user training simulations targeting fake download page phishing scenarios to build recognition skills.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","NIST SP 800-53 SC-44 (Detonation Chambers \u002F Application Isolation)","NIST SP 800-53 AC-17 (Remote Access Controls)","NIST SP 800-53 SI-3 (Malicious Code Protection)","NIST SP 800-53 IA-5 (Authenticator Management)","NIST CSF DE.CM-1 (Network Monitoring)","GDPR Article 32 – Security of Processing (protection of user credential data)","MITRE ATT&CK T1539 – Steal Web Session Cookie","MITRE ATT&CK T1185 – Browser Session Hijacking",{},"published","2026-08-16T16:20:20.172624+00:00","2026-08-16T16:20:19.871+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-amnesiastealer-macos-malware-hijacks-browser-sessions-via-remote-control\u002F","new-amnesiastealer-macos-malware-hijacks-browser-sessions-via-remote-control-0a6826","New AmnesiaStealer macOS malware hijacks browser sessions via remote control",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":39,"name":40,"slug":41,"description":42,"color":43},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":45,"name":46,"slug":47,"description":48,"color":49},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[51],{"id":52,"date":53,"edition":54,"title":55,"audio_url":56},"3906e11d-5241-486e-8cc3-b38db2a141fc","2026-08-17","morning","ThreatNoir Morning Brief — August 17","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-08-17\u002Fthreatnoir-morning-brief-2026-08-17.mp3",[58,62,66],{"slug":59,"name":60,"problem":61},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":63,"name":64,"problem":65},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":67,"name":68,"problem":69},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool."]