Fake GitHub download turns Safari & Chrome into a Keychain data stealer

Fake GitHub download turns Safari & Chrome into a Keychain data stealer

Jamf Threat Labs has found Mac malware that steals sensitive data and secretly launches a controllable copy of the victim's Chrome or Safari installs, giving attackers a way into accounts that are already unlocked.AmnesiaStealerJamf's August 5 report describes a three-stage AmnesiaStealer infection observed in the wild. The attack begins on a counterfeit GitHub page that tells visitors to paste a command into Terminal.AmnesiaStealer then display…

AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions

The Rust-based macOS infostealer harvests users’ passwords, keychain information, Chromium-based browser data, and Safari cookies. The post AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions appeared first on SecurityWeek.

AmnesiaStealer macOS Malware Hijacks Browser Sessions via Fake GitHub Lure

A newly identified macOS infostealer called AmnesiaStealer is spreading via a convincing fake GitHub download page, tricking Mac users into pasting a malicious Terminal command that silently installs malware and can later grant attackers live, hidden control of the victim’s browser session. Security researchers at Jamf Threat Labs discovered the campaign after spotting a counterfeit site at github.aoitour[.]com that near-perfectly copies GitHub’…