AmnesiaStealer is a new macOS malware that uses ClickFix attacks to hijack your browser and control it live. Learn how it works and how to protect yourself.
You're probably used to thinking of malware as something that quietly sits in the background, stealing passwords or logging keystrokes. But a new threat called AmnesiaStealer is doing something far more unsettling: it's hijacking your browser and letting an attacker control it live, right in front of you.
This isn't a theoretical risk or a proof-of-concept. AmnesiaStealer is actively targeting macOS users through a clever social engineering trick called ClickFix. And while Macs have long enjoyed a reputation for being safer than Windows machines, this malware shows just how quickly that assumption can be shattered.
### What Is AmnesiaStealer and How Does It Get In?
AmnesiaStealer is an information-stealing malware that spreads through what security researchers call ClickFix attacks. The premise is simple: you land on a website that looks legitimate, and you're told your browser needs an update or a security check. You're then instructed to copy a command and paste it into your terminal or run it directly.
That's the trap. Instead of fixing anything, the command downloads and installs AmnesiaStealer onto your Mac. The name "ClickFix" comes from the fact that the attack uses fake error messages to trick you into "fixing" a problem that doesn't actually exist.
Once installed, the malware doesn't just steal your saved passwords or cookies. It goes a step further by including a streaming module that allows the attacker to interactively control your browser in real time. That means they can see what you see, click where you click, and even type in your name, address, or payment details without you realizing it.
### Why Remote Browser Control Is So Dangerous
Most stealers grab your data and send it off to a server. AmnesiaStealer is different because it gives the attacker a live window into your browsing session. Imagine you're logged into your bank account, and the attacker uses your session to transfer money or change your password. You might not notice until it's far too late.
The streaming module also lets the attacker bypass two-factor authentication in some cases. If you receive a text message with a code and type it into the browser, the attacker sees it in real time. They can then use that code to complete a transaction or log into another account.
This level of control makes AmnesiaStealer particularly dangerous for anyone who does banking, shopping, or work-related tasks on their Mac. It's not just about losing your passwords; it's about losing control of your digital identity.
### How to Protect Yourself From ClickFix Attacks
The good news is that ClickFix attacks rely on human error, which means you can defend against them with a few simple habits. Here are some practical steps you can take right now:
- Never copy and paste commands from a website into your terminal unless you're absolutely certain it's safe. Legitimate websites never ask you to do this.
- Keep your browser and operating system updated. While updates won't stop every attack, they patch known vulnerabilities that malware often exploits.
- Use a reputable antivirus or endpoint protection tool that includes real-time browser monitoring.
- Enable "Gatekeeper" on your Mac to block apps from unidentified developers.
- Be suspicious of any website that suddenly claims your browser is broken, outdated, or infected. These are classic scare tactics.
If you're a professional who relies on your browser for sensitive work, consider using a dedicated browser profile for high-risk activities. You can also use a virtual machine or a separate device for anything involving financial transactions.
### The Bigger Picture: Browser Security Is Everyone's Problem
AmnesiaStealer is a reminder that no platform is immune to modern threats. macOS has a strong security model, but it can't protect you from yourself. The most sophisticated malware still needs you to take an action, whether that's clicking a link, downloading a file, or pasting a command.
That's why staying informed is your best defense. The more you know about how these attacks work, the harder it is for criminals to trick you. And if you ever suspect that your browser is being controlled remotely, disconnect from the internet immediately, close your browser, and run a full security scan.
### Final Thoughts
AmnesiaStealer is a wake-up call for anyone who thought Macs were immune to serious malware. The ability to control your browser in real time is a level of intrusion that goes beyond simple data theft. It's a direct invasion of your digital life.
But you don't have to live in fear. By understanding how ClickFix attacks work and adopting a few cautious habits, you can significantly reduce your risk. Stay alert, stay curious, and never let a random website tell you what to do with your computer.
