This macOS Malware Can Take Over Your Browser in Real Time

Robert Moore · 2026-08-16

You've probably heard about malware that steals passwords or plants ransomware. But here's something creepier: a new macOS threat called AmnesiaStealer doesn't just grab your data—it can watch and control your browser as if the attacker were sitting in your chair. That's a whole different level of intrusion. Discovered in the wild, AmnesiaStealer spreads through what security researchers call ClickFix attacks. The name sounds harmless, but the technique is anything but. Here's how it works: you land on a compromised website, see a fake error message, and get told to open your Terminal and paste a command to "fix" the issue. Spoiler alert: that command doesn't fix anything. It downloads malware straight onto your Mac. ### Why ClickFix Attacks Are So Effective ClickFix is sneaky because it doesn't rely on you downloading a shady file from an email attachment. Instead, it uses social engineering that feels legitimate. The fake error prompts are designed to look like real macOS system messages, complete with instructions that even a cautious user might follow. - The prompt mimics a standard macOS alert box, making it hard to spot as a fake. - It asks you to run a command that looks technical but is actually malicious. - The attack works in the background while you think you're solving a problem. The end result is that AmnesiaStealer gets installed without raising any red flags. And once it's on your system, the real trouble begins. ### The Streaming Module: Your Browser, Their Hands What sets AmnesiaStealer apart from other infostealers is its streaming module. This isn't just a keylogger or a credential grabber. The malware can stream your browser session live to the attacker. They see what you see, in real time. But it gets worse—they can also send commands back, moving your mouse, clicking links, and typing in forms. Imagine logging into your bank account while someone else watches every keystroke and even takes over the session. They could initiate a transfer, change your settings, or empty your cart on an e-commerce site. The level of control is terrifying because it's not just passive theft; it's active manipulation. ### How to Protect Your Mac So what can you do about it? First, be skeptical of any website that asks you to run Terminal commands. Legitimate sites never do that. If you see a pop-up telling you to paste a command into Terminal, close the browser tab immediately. Second, keep your macOS and browser updated. While this specific malware is new, the vulnerabilities it exploits are often patched in updates. Enabling automatic updates adds a layer of protection. Third, consider using a dedicated antidetect browser if you need to work with multiple online identities. These browsers isolate your sessions and make it harder for malware to hijack your activity. They also provide a layer of obfuscation that can confuse attackers. ### The Bottom Line: Don't Panic, But Stay Sharp AmnesiaStealer is a reminder that macOS isn't immune to serious threats. The days of thinking "Macs don't get viruses" are long gone. The key is to stay vigilant and adopt good habits. Don't run random commands, don't click suspicious pop-ups, and always question unexpected prompts. If you suspect your Mac is compromised, disconnect from the internet immediately and run a full security scan. You can also check your browser extensions and login sessions for anything unfamiliar. The sooner you act, the less damage an attacker can do. This malware is a wake-up call. The tools we rely on for work and play can be turned against us in ways we never imagined. But with a little awareness and a few smart habits, you can keep your browser—and your data—out of the wrong hands.