Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser sessions.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You land on a GitHub page: big title, “Download for macOS,” shiny “verified publisher” badge. Looks legit, right? This one’s AmnesiaStealer. It tells you: copy this Base64 command into Terminal. Then a fake installer pops up, looping “Incorrect password. Please try again.” until you give your real macOS password. Once it has that, AmnesiaStealer quietly raids your Keychain, Chrome cookies and logins, Apple Notes, Telegram, and even lets someone drive your live browser sessions in the background, no password needed. Aha rule: if any “Download for macOS” page tells you to paste a command into Terminal, stop. Don’t run it, report it to IT Security and grab the app from the official site instead.
Researchers say a real macOS malware campaign is using “ClickFix” social engineering to trick users into installing an infostealer called AmnesiaStealer. Victims are lured to a counterfeit GitHub download page that encourages them to copy/paste a Terminal command, which then downloads and runs the…
Researchers found a real macOS malware campaign that uses a fake GitHub download page to convince users to paste a command into Terminal and enter their Mac password. The malware then steals credentials, cookies, and files, and can even turn the victim’s Chromium browser into a remotely controlled…
Researchers documented a real macOS data-stealing campaign that relies on social engineering instead of software bugs. Victims are sent to a fake “verification” page that tells them to copy and paste a command into Terminal, which silently installs a stealer and then pressures them to enter their…
A macOS info-stealing malware called ClickLock Stealer uses a fake “Cloudflare verification” page to trick users into copying and running a Terminal command. It then steals browser, crypto wallet, and Keychain data and sends it to attackers via a Telegram bot, while killing processes to hide…
Researchers found real GitHub repositories containing poisoned AI-agent instruction/config files (like CLAUDE.md and .cursorrules) that silently tell coding assistants to steal prompts, environment variables, and credentials. The malicious instructions can trigger hidden commands (for example, curl…
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
