Credit: Perawit Boonchu / iStock via Getty Images

In a new ClickFix attack iteration, hackers are pushing an infostealing malware to macOS users that is capable of hijacking your sessions in Google Chrome, Microsoft Edge, and a number of other Chromium-based browsers. AmnesiaStealer grants remote control of your browser and access to plenty of personal data, so you should know how to spot the campaign and protect your device from compromise.

As BleepingComputer reports, AmnesiaStealer can copy a victim's Chromium profile, which allows it to collect data across 16 Chromium-based web browsers, access authenticated sessions, and control them remotely. This means threat actors can navigate across websites, export or import cookies, and access online portals as well as grab saved logins, history, bookmarks, extensions, and cryptocurrency wallet data. AmnesiaStealer can also capture your macOS password and gain access to keychain data, Apple Notes, Telegram sessions, documents, and system information.

Researchers at security company Jamf found that hackers are distributing the malware via a password-protected ZIP archive on a fake GitHub page and are gaining this level of access when users run a Terminal command that downloads and installs the payload. The campaign mirrors previously identified Atomic and MacSync infostealers.

The best way to protect yourself from AmnesiaStealer is to be vigilant against ClickFix attacks, which use social engineering tactics to deliver malware to your device. Common tricks include fake error messages, CAPTCHA forms, and, as in this case, command prompts that install malicious payloads that can then spy on your activity, steal your data, and take over your machine.

Threat actors count on you believing that these commands do something innocuous (like download legitimate software) or not understanding what you're executing on your device. That's why you should be highly skeptical of any prompts you find online and never execute commands in Terminal from non-official sources. Note that the fake GitHub page being used to distribute AmnesiaStealer has a "Verified Publisher" tag to gain user trust. Fraudsters will also try to impersonate legitimate companies—tech support scams are one example—so you should never copy and paste commands in your system dialogue even if you believe you're interacting with a trusted business or service.