As reported by Security Affairs, Jamf Threat Labs has disclosed AmnesiaStealer, a multi-stage Rust-based infostealer targeting macOS users through convincingly spoofed GitHub download pages. What distinguishes this threat from typical stealers isn't just what it takes — it's the live, interactive control it hands attackers over a victim's browser session.
Why This Threat Is More Dangerous Than a Standard Infostealer
Most infostealers operate on a grab-and-go model: exfiltrate credentials, cookies, and autofill data, then report back to a command-and-control server. AmnesiaStealer's architecture goes further by maintaining persistent, real-time access to the victim's browser environment. This transforms a passive data theft tool into an active session hijacking platform — meaning attackers don't need to crack passwords or bypass MFA after the fact. They're already inside an authenticated session.
The ClickFix delivery mechanism is particularly concerning. By impersonating GitHub — one of the most universally trusted platforms among developers, DevOps engineers, and security practitioners — the threat actors have deliberately targeted a high-value demographic. This isn't spray-and-pray malware. The targeting suggests a calculated focus on individuals with privileged access to source code repositories, CI/CD pipelines, cloud environments, and internal tooling.
The macOS Threat Landscape Is Maturing Fast
For years, macOS was treated as an afterthought in enterprise threat modeling. That assumption is rapidly becoming a liability. The use of Rust as the implementation language is a deliberate choice by adversaries: Rust binaries are notoriously difficult to reverse-engineer, compile to compact and efficient native code, and often evade signature-based detection that was tuned against traditional macOS malware written in Objective-C, Swift, or Python.
Organizations that have deployed macOS at scale — particularly in engineering, finance, and executive roles — should treat this disclosure as a wake-up call. The "Macs don't get malware" era is not just over; it's being actively exploited.
The multi-stage nature of the infection chain is also notable. Multi-stage loaders are harder to detect at any single point because each stage may appear benign in isolation. Traditional endpoint detection focused on payload execution may miss early-stage dropper activity entirely.
Who Is Most at Risk
The ClickFix Social Engineering Problem
ClickFix — the technique of tricking users into manually executing malicious commands or scripts under the guise of fixing a technical issue — has seen explosive adoption among threat actors in 2024 and into 2025. It's effective precisely because it bypasses many automated defenses by making the user the final execution vector. No exploit, no zero-day — just a convincing prompt and a distracted human.
Security awareness training must be updated to explicitly cover ClickFix scenarios, particularly in developer-focused environments where the instinct to "run this script" is already deeply normalized. If your organization has never run a simulated ClickFix phishing exercise, that gap needs to close now.
Shield53 Recommendations
Immediate Actions
- Audit macOS endpoint protection coverage. Ensure all macOS devices — including BYOD — are enrolled in MDM and running an EDR solution with macOS behavioral detection capabilities (not just signature scanning).
- Deploy application allowlisting or notarization enforcement. macOS Gatekeeper and notarization requirements should be enforced; review any exceptions currently in place that could allow unsigned or ad-hoc signed binaries to execute.
- Hunt for Rust binary execution anomalies. Query your EDR for unusual Rust-compiled binary executions in user-space directories (~/Downloads, /tmp, ~/Library) — these are atypical in normal macOS workflows.
- Review browser extension inventory. AmnesiaStealer's browser control capability may involve extension abuse or native messaging — audit installed extensions across your macOS fleet immediately.
- Implement phishing-resistant MFA. While live session hijacking can bypass traditional MFA, passkeys and hardware security keys (FIDO2) significantly raise the bar for attackers attempting to pivot from a stolen session.
Longer-Term Controls
- Train developer and engineering teams specifically on ClickFix-style lures — include simulated exercises on fake GitHub, GitLab, and npm pages.
- Enforce browser isolation or enterprise browser policies that restrict clipboard-based script execution prompts.
- Implement network-layer DNS filtering to catch C2 beaconing before data exfiltration completes.
- Require code signing and verify provenance for any tools downloaded outside of sanctioned package managers (Homebrew formulae with verified taps, App Store, internal artifact repositories).
AmnesiaStealer is a clear signal that macOS-targeting threat actors are investing in sophistication, targeting precision, and operational capability. Organizations that haven't formalized a macOS-specific threat model within their security program should treat this disclosure as the impetus to start.
