A ClickFix lure, then live control of the browser
BleepingComputer described AmnesiaStealer as a new macOS information stealer that uses ClickFix lures and then gives the operator more than simple data theft. The notable feature is a streaming module that lets the attacker interact with the victim's browser in real time.
An attacker who can drive a browser that is already signed in doesn't need the password. The response then has to cover account abuse, token theft and the SaaS apps behind those sessions, as well as malware cleanup.
Working inside sessions that are already signed in
Most infostealers take files, passwords or cookies and stop there. With interactive browser control, the operator can work inside the victim's existing sessions instead of replaying credentials from somewhere else.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
That leaves defenders less time. The user thinks they just clicked through a support or verification prompt. Meanwhile the attacker can already be in their email, chat, cloud console or finance tools in the same browser.
ClickFix gets the user to run the command
ClickFix keeps working because people are used to following fix-it instructions. The lure needs no exploit if it can get someone to run a command, approve a prompt or follow a fake repair flow.
The family name matters less than the delivery method. These lures keep giving attackers more control after the click.
Revoke live sessions, not just passwords
Plan the response around stolen sessions as well as the malware itself.
- Check whether macOS users in your environment could be reached with ClickFix-style prompts through chat, docs, browser popups, or support-themed lures.
- Review browser-session protections, suspicious cookie use, unusual OAuth grants, and recent sign-ins tied to users who may have interacted with fake repair or verification prompts.
- Check whether help-desk guidance and user training explicitly cover fake terminal or browser troubleshooting prompts on macOS.
- Contain affected endpoints quickly and assume live browser sessions, not just stored passwords, may need to be invalidated.
- Brief the owners of high-value SaaS apps that a compromised browser session can be as damaging as a stolen password when MFA has already been satisfied.
Email, cloud and finance all run through the browser
Session hijacking is not only a job for the browser or identity team. Users reach email, cloud consoles, support tools, finance apps and chat through the browser, so the owners of those systems need to be in the response too.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Sources
Primary source: BleepingComputer's reporting on AmnesiaStealer.
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Friday’s brief: Cisco VPN firewalls under attack, then GitLab, Synology NAS ransomware and Cisco SD-WAN spyware
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
