Mac users are being freshly warned of suspicious websites asking them to open Terminal and install software. Jamf Threat Labs has uncovered a multi-stage macOS infostealer, dubbed AmnesiaStealer, that uses a ClickFix-style fake GitHub download page to trick victims into executing a command that installs malware.
The campaign is designed to steal credentials and sensitive data before escalating into silent, interactive control of the victim’s Chromium browser, Jamf researchers said in a blog post.
The attack was found mimicking GitHub’s dark theme, Octocat branding and a “Verified Publisher” badge. Instead of providing an application, as promised in the lure, the page tells users to open Term...