AmnesiaStealer macOS Malware: ClickFix Delivery and Browser Session Hijacking — Detection and Response Guide

---
title: macOS ClickFix Shell Pipe Execution via Terminal
description: Detects curl/wget piped directly to a shell interpreter from Terminal or iTerm, the hallmark of ClickFix-style paste-and-run lures.
references:
  - https://www.bleepingcomputer.com/news/security/new-amnesiastealer-macos-malware-hijacks-browser-sessions-via-remote-control/
  - https://attack.mitre.org/techniques/T1059/004/
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2026/04/06
id: 3f8a1c54-2b7e-4d91-a6c0-9e5f2d8b4a71
status: experimental
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1204
logsource:
  category: process_creation
  product: macos
detection:
  selection_parent:
    ParentImage|endswith:
      - '/Terminal'
      - '/iTerm2'
      - '/Terminal.app/Contents/MacOS/Terminal'
  selection_cmd:
    CommandLine|contains:
      - 'curl'
      - 'wget'
  selection_pipe:
    CommandLine|contains:
      - '| bash'
      - '| sh'
      - '| zsh'
      - '|bash'
      - '|sh'
      - '|zsh'
  condition: selection_parent and selection_cmd and selection_pipe
falsepositives:
  - Developer bootstrap scripts (Homebrew installs, dev environment setup) — tune by parent process and destination domain
level: high
---
title: macOS Base64 Encoded Command Execution via osascript or Shell
description: Detects execution of base64-decoded commands through osascript or shell interpreters, a common ClickFix obfuscation layer used to stage AmnesiaStealer-style payloads.
references:
  - https://www.bleepingcomputer.com/news/security/new-amnesiastealer-macos-malware-hijacks-browser-sessions-via-remote-control/
  - https://attack.mitre.org/techniques/T1027/
  - https://attack.mitre.org/techniques/T1059/002/
author: Security Arsenal
date: 2026/04/06
id: 8c2e5b19-4f6a-47d3-b1e8-3a9c7d5f2e60
status: experimental
tags:
  - attack.defense_evasion
  - attack.t1027
  - attack.execution
  - attack.t1059.002
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    CommandLine|contains:
      - 'base64 -d'
      - 'base64 --decode'
      - 'base64 -D'
      - 'echo '
  selection_interpreter:
    Image|endswith:
      - '/osascript'
      - '/bash'
      - '/zsh'
      - '/sh'
      - '/python3'
  condition: selection and selection_interpreter
falsepositives:
  - Legitimate automation and MDM scripts — whitelist known management tool parent processes
level: medium
---
title: Unsigned Binary Execution from User-Writable macOS Paths
description: Detects execution of binaries from /tmp, /var/tmp, /Users/Shared, or hidden directories in user home folders — typical staging locations for macOS stealers dropped via shell one-liners.
references:
  - https://www.bleepingcomputer.com/news/security/new-amnesiastealer-macos-malware-hijacks-browser-sessions-via-remote-control/
  - https://attack.mitre.org/techniques/T1036/
author: Security Arsenal
date: 2026/04/06
id: 5d1a9f36-7c48-4e2b-83a1-6b4e0c9d5f83
status: experimental
tags:
  - attack.defense_evasion
  - attack.t1036
  - attack.execution
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|contains:
      - '/tmp/'
      - '/var/tmp/'
      - '/Users/Shared/'
      - '/Library/Caches/'
      - '/.'
  filter_apps:
    Image|startswith:
      - '/Applications/'
      - '/System/'
      - '/usr/'
      - '/bin/'
      - '/sbin/'
  condition: selection and not filter_apps
falsepositives:
  - Some installer and updater frameworks stage in /tmp — correlate with parent process and code-signing status from EDR
level: medium

// Hunt 1: ClickFix-style shell pipe execution and encoded commands on macOS endpoints
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where DeviceOSPlatform has "macOS"
| where ProcessCommandLine has_any ("| bash", "| sh", "| zsh", "base64 -d", "base64 -D", "base64 --decode")
    or (FileName in~ ("curl", "wget") and ProcessCommandLine has "http" and ProcessCommandLine has "|")
    or (FileName =~ "osascript" and ProcessCommandLine has_any ("curl", "base64", "do shell script"))
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, ReportId
| order by TimeGenerated desc
;

// Hunt 2: Suspicious outbound connections from shell-spawned processes on macOS (streaming module behavior)
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where DeviceOSPlatform has "macOS"
| where InitiatingProcessFileName in~ ("bash", "zsh", "sh", "python3", "osascript")
    or InitiatingProcessFolderPath has_any ("/tmp/", "/var/tmp/", "/Users/Shared/", "/Library/Caches/")
| where RemotePort in (443, 8443, 8080, 80)
| where RemoteIPType == "Public"
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
            RemoteIPs = make_set(RemoteIP, 20), URLs = make_set(RemoteUrl, 20)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
| where ConnectionCount > 5
| order by ConnectionCount desc

-- AmnesiaStealer / ClickFix hunt: process lineage, staged binaries, and LaunchAgent persistence on macOS
-- Section 1: Live processes matching ClickFix execution or staging paths
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(\|\s*(bash|sh|zsh)|base64\s+(-d|-D|--decode)|osascript.*do shell script)'
   OR Exe =~ '(?i)^(/tmp/|/var/tmp/|/Users/Shared/|/Users/[^/]+/Library/Caches/)'

-- Section 2: Recently created or modified LaunchAgents/LaunchDaemons (persistence check)
SELECT FullPath, Mtime, Btime, Size,
       read_file(filename=FullPath, length=2048) AS PlistHead
FROM glob(globs=['/Users/*/Library/LaunchAgents/*.plist',
                 '/Library/LaunchAgents/*.plist',
                 '/Library/LaunchDaemons/*.plist'])
WHERE Mtime > now() - (7 * 24 * 3600)
ORDER BY Mtime DESC

#!/bin/bash
# AmnesiaStealer / ClickFix macOS triage and hardening script
# Run as root via MDM or during IR triage. Read-only audit — no destructive actions.

REPORT="/var/tmp/amnesiastealer_triage_$(date +%Y%m%d_%H%M%S).txt"
echo "=== AmnesiaStealer/ClickFix Triage — $(date) ===" | tee "$REPORT"

# 1. Audit LaunchAgents/LaunchDaemons created in the last 14 days
echo -e "\n[+] Recent persistence plists (last 14 days):" | tee -a "$REPORT"
find /Users/*/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons \
  -name "*.plist" -mtime -14 -exec ls -la {} \; 2>/dev/null | tee -a "$REPORT"

# 2. Flag plists pointing at suspicious executable paths
echo -e "\n[+] Plists referencing suspicious paths:" | tee -a "$REPORT"
grep -rlE "(/tmp/|/var/tmp/|/Users/Shared/|curl|base64)" \
  /Users/*/Library/LaunchAgents /Library/LaunchAgents 2>/dev/null | tee -a "$REPORT"

# 3. Find executables staged in user-writable locations
echo -e "\n[+] Executables in staging paths:" | tee -a "$REPORT"
find /tmp /var/tmp /Users/Shared -type f -perm +111 -mtime -14 2>/dev/null | tee -a "$REPORT"

# 4. Check code-signing status of anything found (unsigned = high suspicion)
echo -e "\n[+] Signature check on staged executables:" | tee -a "$REPORT"
find /tmp /var/tmp /Users/Shared -type f -perm +111 -mtime -14 2>/dev/null | while read -r f; do
  sig=$(codesign -dv "$f" 2>&1 | head -1)
  echo "$f :: $sig" | tee -a "$REPORT"
done

# 5. Scan shell histories for ClickFix indicators (curl-pipe-shell, base64, osascript abuse)
echo -e "\n[+] Shell history ClickFix indicators:" | tee -a "$REPORT"
for h in /Users/*/.zsh_history /Users/*/.bash_history; do
  [ -f "$h" ] && grep -nE "(curl.*\|.*(bash|sh|zsh)|base64 -(d|D)|osascript.*do shell script)" "$h" 2>/dev/null \
    | sed "s|^|$h:|" | tee -a "$REPORT"
done

# 6. List active network connections from non-standard processes
echo -e "\n[+] Established outbound connections (non-system processes):" | tee -a "$REPORT"
lsof -iTCP -sTCP:ESTABLISHED -P -n 2>/dev/null | grep -vE "(rapportd|mDNSResponder|StudentD|system_)" | tee -a "$REPORT"

# 7. Hardening check: verify Gatekeeper and XProtect are enabled
echo -e "\n[+] Gatekeeper status:" | tee -a "$REPORT"
spctl --status 2>&1 | tee -a "$REPORT"
echo -e "\n[+] XProtect version:" | tee -a "$REPORT"
/usr/libexec/PlistBuddy -c "Print :CFBundleShortVersionString" \
  /Library/Apple/System/Library/CoreServices/XProtect.app/Contents/Info.plist 2>&1 | tee -a "$REPORT"

# 8. Check for Full Disk Access grants to unexpected apps (stealers abuse TCC)
echo -e "\n[+] TCC Full Disk Access grants (review for anomalies):" | tee -a "$REPORT"
/usr/libexec/PlistBuddy -c "Print" /Library/Application\ Support/com.apple.TCC/MDMOverrides.plist 2>/dev/null | tee -a "$REPORT"
sqlite3 "/Library/Application Support/com.apple.TCC/TCC.db" \
  "SELECT client FROM access WHERE service='kTCCServiceSystemPolicyAllFiles' AND auth_value=2;" 2>/dev/null | tee -a "$REPORT"

echo -e "\n=== Triage complete. Report: $REPORT ===" | tee -a "$REPORT"
echo "Next steps if indicators found: isolate host from network, revoke all SaaS sessions for the affected user, rotate credentials, and image or rebuild the endpoint."