Amnesia Stealer Shows the Next Stage of ClickFix on macOS

Amnesia Stealer is another macOS infostealer delivered through a familiar security weakness: convincing a user to take an action they would normally avoid.

The malware is associated with ClickFix-style social engineering, in which a web page presents a fake problem and a supposedly helpful solution. The user is instructed to run code, open a native macOS tool, or install an application. Once the user completes that step, the attacker no longer needs to defeat every platform security control remotely. The user has helped start the attack.

Jamf’s analysis of Amnesia Stealer documents a campaign focused on macOS users and the data that makes infostealers valuable: credentials, browser data, and other information stored in the user’s session. Patrick Wardle added the sample to the Objective-See Foundation’s public macOS malware repository, where it is available for controlled research alongside other Mac malware specimens.

Patrick Wardle shared the Amnesia Stealer sample publicly on LinkedIn, and it is available in the Objective-See macOS malware repository. The archive password is infect3d, as provided in the public post below. These files are available for research, but they are still live malware and should only be downloaded and opened in a controlled, isolated environment.

ClickFix is moving beyond Terminal

ClickFix became associated with a straightforward pattern: a web page tells the user to copy a command, paste it into Terminal, and press Return. That pattern remains dangerous, but it is no longer the whole story.

Jamf Threat Labs has documented ClickFix-style activity that uses the applescript:// URL scheme to open Script Editor with prefilled code. Other campaigns have used compiled AppleScript applications disguised as legitimate utilities, with the initial payload downloading a Rust-based infostealer.

The common feature is not a particular application. It is the abuse of trusted, built-in execution paths and the user’s expectation that a security check or software installation should require an unusual step.

That is why a detection strategy based only on Terminal paste is too narrow. Script Editor, osascript, browser-launched links, downloaded applications, and shell or JXA downloaders all deserve attention when they appear in an unexpected context.

Behaviors worth monitoring

The malware’s name may change quickly. The behaviors required to steal data are more durable.

On managed Macs, I would look for:

AppleScript password prompts, especially /usr/bin/osascript commands containing display dialog and password.
Script Editor or osascript execution that follows a browser session, a downloaded file, or an unexpected URL scheme.
Shell or JXA downloaders that retrieve executables or scripts from newly registered or unfamiliar domains.
Access to browser credential databases, Keychain-related activity, and other sensitive user data.
Newly written executables, plists, or staged payloads in locations such as ~/Library/LaunchAgents, ~/Library/Application Support, and /private/tmp.
New Login Items, LaunchAgents, or other persistence mechanisms created after suspicious script execution.
Unexpected outbound connections following credential prompts or the execution of a downloaded application.

For a Jamf Protect-style analytic, a rule that looks for an AppleScript credential prompt is a reasonable starting point:

Process: /usr/bin/osascript
Command line contains: display dialog
Command line contains: password
Purpose: identify fake AppleScript credential prompts

That will not detect every infostealer and may produce false positives in environments that use legitimate AppleScript administration tools. It is still more durable than blocking one filename or hash because it focuses on the credential-harvesting behavior.

The same principle applies to ClickFix detection. Review the process ancestry, the browser or downloaded-file context, the script interpreter, the destination domain, and what happens immediately afterward. A native tool is not suspicious merely because it is native; it becomes suspicious when it is used in an unusual chain of events.

What defenders can learn from the sample

A preserved sample turns a report into something defenders can test.

Researchers can use it to reproduce execution, inspect persistence, identify data collection, validate endpoint telemetry, and compare future variants. Security teams can use those findings to improve analytics and incident-response playbooks without relying solely on screenshots, filenames, or a vendor’s detection label.

If an organization discovers a suspicious sample, it should preserve the source URL, hashes, signing information, timestamps, screenshots, and relevant endpoint telemetry. The file should remain isolated from production systems and collaboration tools. It should be handled as evidence, not treated like an ordinary attachment.

The Objective-See repository is part of that broader research infrastructure. Patrick Wardle and the Objective-See Foundation have made macOS malware samples available with clear warnings and a research-oriented purpose. The Amnesia Stealer sample belongs in that evidence trail, alongside the analysis that explains how it was delivered and what it attempted to do.

The operational response

User education still matters. A browser page should not need Terminal or Script Editor to prove that someone is human. An unexpected password prompt should be treated as suspicious, especially when it appears immediately after following instructions on a web page. Users should know to stop and contact IT rather than completing the sequence.

Managed Macs should use standard accounts by default. Approved software should come through Self Service or another managed distribution path. Endpoint telemetry should cover scripting interpreters, browser-launched execution, credential-store access, persistence, and suspicious outbound connections. Web filtering and DNS controls should limit access to known malicious infrastructure. Incident-response teams should preserve suspicious files and context so detections can be tested against the evidence.

Amnesia Stealer is not important because its name is unique. It is important because it illustrates the direction of macOS infostealer campaigns: social engineering paired with native execution paths, credential and browser-data theft, and delivery techniques that adapt as users and platforms become familiar with the original ClickFix pattern.