Fake GitHub Doorway Leads to a Mac Stealer Built for Session Theft

Introduction

A polished clone of a familiar software page can be enough to turn curiosity into compromise. In this case, the lure was built to look like a trusted developer portal, while the payload was a newly identified macOS infostealer tracked as AmnesiaStealer. The most consequential detail is not only credential theft, but the reported focus on active Chromium browser sessions. That shifts the attack from password capture to post-login account takeover, where valid browser state may matter more than the password itself.

Fast Facts

• AmnesiaStealer is described as a new macOS infostealer.
• The lure used a ClickFix-style social engineering path.
• A counterfeit GitHub download portal was part of the delivery chain.
• The malware is reported to target credentials and active Chromium browser sessions.
• Stolen browser sessions can sometimes be reused without re-entering a password.

Body

ClickFix is effective because it does not depend on a software bug in the usual sense. It pushes the victim to perform the dangerous step, often by following fake instructions, copy-pasting commands, or approving a misleading install flow. That makes the attack harder to stop with patching alone. The weak point is user trust, not only code execution.

From a defensive perspective, the real prize in this kind of operation is authenticated browser state. MITRE ATT&CK treats stolen web session cookies as a serious access primitive because they can let an attacker act as the victim inside a web app. In plain terms, if an operator can replay a live session, they may not need the password at all. Depending on the service and how the session is managed, that can also reduce the protection value of some MFA setups.

Chromium-based browsers are a common target because they hold the session state that keeps users signed in. The exact extraction method in this case is not publicly clear, so the safest reading is conditional: the malware may be stealing browser session material, or it may be abusing local browser access in another way to reach the same result. What matters operationally is the outcome - an authenticated browser context that can be reused.

The lure itself is also a warning about brand impersonation. A lookalike download page can lend credibility to malicious instructions, especially when it borrows familiar visual cues from a known platform. That combination of social proof and user execution is what makes ClickFix-style campaigns so dangerous: they can turn routine software hunting into self-inflicted compromise.

At the time of writing, public information has not fully established the complete technical path, the full scope of affected users, or whether any downstream systems were compromised.

Conclusion

The lesson here is broader than one macOS family or one fake portal. Browser sessions have become a high-value form of identity, and criminals know it. When a threat can move from “I stole your password” to “I borrowed your already signed-in session,” the defender’s job changes too - from protecting secrets alone to protecting the trust chain around every login.

TECHCROOK

Hardware security key: A hardware security key adds phishing-resistant login protection for email, password managers, and major account portals. It is a practical add-on for users who want stronger sign-in security than app-based codes alone.

Scheda Techcrook: Hardware security key

WIKICROOK

• Infostealer: Malware designed to collect credentials, browser data, or other sensitive information from an infected device.
• ClickFix: A social engineering pattern that tricks users into running commands or making changes under the guise of fixing a problem.
• Session replay: Reusing a stolen authenticated session so an account can be accessed without logging in again.
• Chromium: The open-source browser base used by several popular browsers, including the Chrome family.
• Session cookie: A browser-stored authentication artifact that can keep a user signed in during a web session.