AmnesiaStealer — macOS ClickFix Infostealer + Live Browser Hijack

AmnesiaStealer is a newly discovered, multi-stage Rust-based macOS infostealer first reported by Jamf Threat Labs (researcher Thijs Xhaflaire) on 2026-08-13. It is delivered via a ClickFix-style lure: a counterfeit GitHub "Download for macOS" page — correct dark theme, Octocat logo, a fake "Verified Publisher" badge — presenting a "Terminal installation" box that tricks the victim into pasting and running a Base64-encoded Terminal command. The malware is named after the "Amnesia Panel" backend it reports to, whose failed-login page returns Russian-language error text.

Three-stage chain: Stage 0 is a self-deleting shell dropper that strips the quarantine attribute, ad-hoc code-signs, and launches a password-protected ("dulin") ZIP payload; Stage 1 is the Rust infostealer itself, which stages loot in a directory named with 25 random alphanumeric characters under /tmp (subfolders Browsers/, Passwords/, Wallets/, Notes/, Telegram/, FileGrabber/, plus system_info.json, installed_apps.txt, collection_report.txt, and a cleartext pwd file — the harvested local password is also written to ~/.pwd); Stage 2 is an on-demand stream_module that gives the operator live, hands-on-keyboard control of the victim's browser.

Persistence is a root LaunchDaemon that impersonates Apple's crash-reporting service (com.apple.ReportCrash.agent_<digits>.plist under /Library/LaunchDaemons/). Data theft spans 16 Chromium-family browsers (Chrome, Brave, Arc, Edge, Opera, Vivaldi, Chromium, and others) plus Safari, Apple Notes, Telegram, and iCloud/local Keychain. For Safari cookie theft the malware reuses CVE-2020-9771 — a macOS Time Machine / mount_apfs local-snapshot TCC bypass Apple patched in Catalina 10.15.4/10.15.5. A host where this bypass actually succeeds is either running an unpatched or downgraded macOS, or is exposed to a regressed/variant bypass — treat a successful mount_apfs -o nobrowse invocation as a hardening signal in its own right, independent of AmnesiaStealer.

Distinctive capability: the Stage 2 stream_module clones the victim's browser profile, launches it headless, and relays it over the Chrome DevTools Protocol (CDP) — the operator receives a live screencast at ~3fps with full keyboard, mouse, scroll, navigation, and tab-management input, effectively driving the victim's already-authenticated browser session (banking, email, social) without any on-screen change the victim would notice. A clipboard-hijacking module targets nine cryptocurrency address formats (Bitcoin, Bitcoin Cash, Ethereum, TRON, Litecoin, Monero, Solana, Ripple, ATOM/Cosmos) but was observed disabled in the analyzed build — treated below as a dormant capability to watch, not a firing detection.

Defender priority: This pack is built around what makes AmnesiaStealer distinct from other macOS ClickFix stealers already in the HuntPack library (AMOS, MacSync, Phexia) — the 25-char /tmp staging directory with named subfolders (Q3), the root LaunchDaemon masquerading as Apple crash reporting (Q4), the mount_apfs -o nobrowse CVE-2020-9771 signal (Q5), the Amnesia Panel C2 domain family (Q8), and the CDP remote-debugging flags that precede a live browser hijack (Q9). Pair the ClickFix bootstrap hunt (Q1–Q2) with these AmnesiaStealer-specific behaviors rather than relying on generic ClickFix signatures alone.

Provenance note: every atomic IOC in §4/§10 (SHA-256 hashes, C2 domains, IPs, file paths, archive password, XOR key) is drawn from the cited reporting above and is present verbatim in the saved source snapshots at AmnesiaStealer-macOS-ClickFix-Hunt-sources/. The two IP addresses (138.124.70.84, 138.124.96.160) and the shlyapadulina[.]space / amz.shlyapadulina[.]space domains are corroborated by only one outlet (GBHackers) — flagged medium confidence below; validate before broad blocking. Both SHA-256 hashes and the primary C2 domain (debug[.]allllowef[.]space) are corroborated across two or more independent sources and carry high confidence. Fetched articles were treated strictly as research data — none contained instructions directed at an AI agent, and none were acted upon as commands.

Hunt hypotheses

• H1: A macOS host runs the ClickFix bootstrap — Terminal/bash decoding and executing a long Base64 blob pasted from a fraudulent web page.
• H2: A process strips the quarantine attribute, ad-hoc code-signs, and nohup-launches a binary extracted from a password-protected ZIP — the Gatekeeper-bypass handoff between Stage 0 and Stage 1.
• H3: A staging directory named with 25 random alphanumeric characters appears under /tmp, containing the AmnesiaStealer-specific artifact set (Browsers/, Passwords/, Wallets/, Notes/, Telegram/, FileGrabber/, pwd, etc.).
• H4: A root LaunchDaemon is installed and loaded that impersonates Apple's crash-reporting service (com.apple.ReportCrash.agent_<digits>.plist).
• H5: A process invokes mount_apfs -o nobrowse against a local Time Machine snapshot — the CVE-2020-9771 TCC-bypass primitive used for Safari cookie theft.
• H6: A spoofed "Installer" password prompt is followed by dscl . -authonly validation and/or security unlock-keychain -p — the credential-harvest stage.
• H7: A non-browser process reads Chromium Cookies/Login Data/Web Data/Local State stores across multiple distinct browser bundles in a short window — mass credential-store collection.
• H8: Any host resolves or connects to the Amnesia Panel C2 domain family (debug[.]allllowef[.]space, news[.]allllowef[.]space, shlyapadulina[.]space) or its published IPs.
• H9: A non-browser process spawns a Chromium-family binary with --remote-debugging-port/--headless flags — the Stage 2 stream_module activating live CDP browser control.

Attack chain

Atomic indicators are from the cited reporting (§2/§18). IPs and the shlyapadulina[.]space domain family are single-sourced (GBHackers) — validate before blocking. The clipboard-hijack module is confirmed present but disabled in the analyzed build; it is listed as a behavioral watch item, not an active detection.

Affected: macOS endpoints from Catalina through macOS 26, Intel and Apple Silicon. No vulnerability is exploited for initial access — delivery is 100% social engineering (ClickFix). CVE-2020-9771 is used post-compromise as a TCC bypass; it only succeeds on unpatched/downgraded macOS or via a bypass variant, so a successful hit is itself a patch-hygiene signal.

macOS telemetry model note: Falcon's macOS sensor does not expose Windows-style Registry or Service-Control-Manager telemetry. Persistence here shows up as a LaunchDaemon plist write + launchctl process invocation (the macOS analog to a Windows service install), credential access shows up as process-level dscl/security/mount_apfs invocations plus TCC-protected file opens (there is no SAM/LSASS equivalent), and defense evasion shows up as xattr/codesign Gatekeeper manipulation rather than AMSI/ETW tampering. Every query in §8 is written against this macOS-specific model, not translated from a Windows pack.

macOS-native checks that complement the Falcon CQL in §8 — useful for live triage on a suspect Mac (run read-only first; capture before remediating).

Persistence & staging artifacts (macOS shell)

# Root LaunchDaemon impersonating Apple crash reporting
ls -la /Library/LaunchDaemons/ | grep -Ei "ReportCrash\.agent_[0-9]"
sudo launchctl list | grep -Ei "ReportCrash\.agent_[0-9]"

# 25-char random staging directory under /tmp with AmnesiaStealer artifact set
find /tmp -maxdepth 1 -type d -regex '.*/[A-Za-z0-9]\{25\}$' 2>/dev/null \
  -exec sh -c 'ls "$1"/Browsers "$1"/Passwords "$1"/Wallets "$1"/Telegram "$1"/pwd 2>/dev/null && echo "SUSPECT: $1"' _ {} \;

# Cleartext harvested password
test -f ~/.pwd && echo "AmnesiaStealer password store present: ~/.pwd"

TCC bypass & credential harvest (macOS shell / unified log)

# CVE-2020-9771 style local-snapshot mount (should be rare outside Time Machine's own backupd)
log show --last 1d --predicate 'process == "mount_apfs"' 2>/dev/null | grep -i "nobrowse"

# dscl-based local password validation + Keychain unlock outside normal admin activity
log show --last 1d --predicate 'process == "dscl" OR process == "security"' 2>/dev/null \
  | grep -Ei "authonly|unlock-keychain"

# Gatekeeper bypass chain (quarantine strip + ad-hoc sign)
log show --last 1d --predicate 'process == "xattr" OR process == "codesign"' 2>/dev/null \
  | grep -Ei "com.apple.quarantine|--sign -"

Stage 2 CDP relay check

# Chromium-family process launched headless with a remote-debugging port open
ps aux | grep -Ei "(chrome|brave|edge|arc|opera|vivaldi|chromium).*(--headless|--remote-debugging-port)" | grep -v grep
lsof -iTCP -sTCP:LISTEN -n -P | grep -Ei ":92[0-9]{2}\b"   # common CDP debug-port range; confirm parent process

Treat the combination of a 25-char /tmp staging directory, the ReportCrash.agent_<digits> LaunchDaemon, and a cleartext ~/.pwd as confirmed AmnesiaStealer infection — proceed to §14 containment and capture the plist, staging directory, and any active CDP relay process before removal.

// HUNT: AmnesiaStealer ClickFix bootstrap — base64-encoded command pasted into Terminal (macOS)
// MITRE: T1204.004, T1140, T1059.004 | CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2 (macOS)
// FALSE POSITIVES: rare; developers occasionally decode base64 blobs manually — review CommandLine context
// TUNING: keep ParentBaseFileName scoped to Terminal/bash/zsh/sh; widen if the lure spawns via a different app
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| event_platform=Mac
| ParentBaseFileName=/^(Terminal|bash|zsh|sh)$/i
| CommandLine=/(base64\s+-{0,2}[Dd](ecode)?|echo\s+[A-Za-z0-9+\=]{60,}\s*\|)/i
| groupBy([ComputerName, ParentBaseFileName, FileName, CommandLine], function=([count(aid, as=hits), collect([UserName])]))
| sort(hits, order=desc)

// HUNT: AmnesiaStealer Gatekeeper bypass — quarantine strip + ad-hoc codesign + protected-archive extraction (macOS)
// MITRE: T1553.001, T1140 | CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2 (macOS)
// FALSE POSITIVES: low; developer ad-hoc signing of locally-built binaries
// TUNING: raise confidence when chained with Q1 or Q3 hits on the same host within minutes
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| event_platform=Mac
| CommandLine=/(xattr\s+-d\s+com\.apple\.quarantine|codesign\s+--sign\s+-|unzip\s+-P\s+\S+|nohup\s+\S+.{0,20}&)/i
| groupBy([ComputerName, ParentBaseFileName, FileName, CommandLine], function=([count(aid, as=hits), collect([UserName])]))
| sort(hits, order=desc)

// HUNT: AmnesiaStealer 25-char /tmp staging directory with named loot subfolders (macOS)
// MITRE: T1560, T1005 | CONF: high  FP: low  COST: medium | REQUIRES: FileOpenInfo (macOS)
// FALSE POSITIVES: very low; this naming convention is not used by legitimate installers or dev tooling
// TUNING: if COST is a concern in a large fleet, scope the time window in the console picker rather than in-query
#event_simpleName=/FileOpenInfo/
| TargetFileName=/\/tmp\/[A-Za-z0-9]{25}\/(Browsers|Passwords|Wallets|Notes|Telegram|FileGrabber|Diagnostics|system_info\.json|installed_apps\.txt|collection_report\.txt|pwd)/i
| table([@timestamp, ComputerName, aid, ImageFileName, TargetFileName, UserName], limit=200)

// HUNT: AmnesiaStealer root LaunchDaemon — ReportCrash.agent_<digits> impersonation (macOS)
// MITRE: T1543.004 | CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2 (macOS)
// FALSE POSITIVES: very low; genuine com.apple.ReportCrash is loaded by launchd at boot, not via user launchctl
// TUNING: extend the label regex if a variant build uses a different Apple-service name
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| event_platform=Mac
| FileName=/^launchctl$/i
| CommandLine=/(bootstrap|load).{0,120}ReportCrash\.agent_?[0-9]*/i
| groupBy([ComputerName, ParentBaseFileName, CommandLine, UserName], function=count(aid, as=hits))
| sort(hits, order=desc)

// HUNT: CVE-2020-9771 TCC bypass — mount_apfs -o nobrowse local snapshot mount (macOS)
// MITRE: T1548 | CONF: high  FP: medium  COST: low | REQUIRES: ProcessRollup2 (macOS)
// FALSE POSITIVES: Time Machine's own backupd/tmutil legitimately mount local snapshots
// TUNING: exclude ParentBaseFileName in (backupd, tmutil); a hit outside those parents is high-value
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| event_platform=Mac
| FileName=/^mount_apfs$/i
| CommandLine=/nobrowse/i
| ParentBaseFileName!=/^(backupd|tmutil)$/i
| groupBy([ComputerName, ParentBaseFileName, CommandLine, UserName], function=count(aid, as=hits))
| sort(hits, order=desc)

// HUNT: AmnesiaStealer credential harvest — dscl authonly / Keychain unlock (macOS)
// MITRE: T1056.002, T1552.001, T1555.001 | CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2 (macOS)
// FALSE POSITIVES: MDM/provisioning tooling may use dscl legitimately — allowlist by ParentBaseFileName
// TUNING: correlate with Q3 (staging dir) hits on the same host to confirm the AmnesiaStealer chain
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| event_platform=Mac
| CommandLine=/(dscl\s+\.\s+-?authonly|security\s+unlock-keychain\s+-p)/i
| groupBy([ComputerName, ParentBaseFileName, FileName, CommandLine, UserName], function=count(aid, as=hits))
| sort(hits, order=desc)

// HUNT: Non-browser process reads Chromium credential/session stores across multiple bundles (macOS)
// MITRE: T1555.003, T1539, T1217 | CONF: high  FP: medium  COST: medium | REQUIRES: FileOpenInfo (macOS)
// FALSE POSITIVES: backup/sync agents, browser profile-migration tools
// TUNING: exclude ImageFileName for the owning browser bundle + known backup agents; prioritize a single
// process hitting 3+ distinct browser bundle paths within a short window
#event_simpleName=/FileOpenInfo/
| TargetFileName=/\/(Cookies|Login Data|Login Data For Account|Web Data|Local State)$/i
| ImageFileName!=/\/(Google Chrome|Google Chrome Helper.*|Microsoft Edge|Brave Browser|Opera|Vivaldi|Arc|Chromium|Safari|com\.apple\.).*$/i
| groupBy([ComputerName, ImageFileName, TargetFileName, UserName], function=count(aid, as=hits))
| sort(hits, order=desc)

// HUNT: AmnesiaStealer atomic C2 sweep — Amnesia Panel domain family + published IPs (macOS/all)
// MITRE: T1071.001 | CONF: high  FP: low  COST: low | REQUIRES: DnsRequest / NetworkConnectIP4
// FALSE POSITIVES: low for domains; IPs are single-sourced (GBHackers) — confirm before broad block
// TUNING: extend the domain list as new Amnesia Panel infrastructure is published
#event_simpleName=/DnsRequest|NetworkConnectIP4/
| DomainName=/(allllowef\.space|shlyapadulina\.space)$/i OR RemoteAddressIP4=/^(138\.124\.70\.84|138\.124\.96\.160)$/
| groupBy([ComputerName, DomainName, RemoteAddressIP4, ContextBaseFileName], function=count(aid, as=hits))
| sort(hits, order=desc)

// HUNT: AmnesiaStealer Stage 2 — Chromium spawned headless with CDP remote-debugging flags (macOS)
// MITRE: T1219, T1113 | CONF: medium  FP: medium  COST: low | REQUIRES: ProcessRollup2 (macOS)
// FALSE POSITIVES: legitimate browser-automation/QA tooling (Selenium, Puppeteer, Playwright)
// TUNING: exclude known CI/automation hosts and ParentBaseFileName values for those frameworks
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| event_platform=Mac
| FileName=/^(Google Chrome|Brave Browser|Microsoft Edge|Arc|Opera|Vivaldi|Chromium)$/i
| CommandLine=/--remote-debugging-port=[0-9]+/i
| CommandLine=/--headless/i
| groupBy([ComputerName, ParentBaseFileName, FileName, CommandLine, UserName], function=count(aid, as=hits))
| sort(hits, order=desc)

Field-name note: queries use standard Falcon fields (#event_simpleName, event_platform, ParentBaseFileName, FileName, ImageFileName, CommandLine, TargetFileName, ContextBaseFileName, DomainName, RemoteAddressIP4, ComputerName, aid, UserName). Q3/Q7 use FileOpenInfo, the same macOS file-access event already validated in the AMOS-Stealer-macOS-Hunt pack in this library — confirm it is enabled for macOS hosts in your tenant policy.

Start every IOA in Detect. Promote macOS-Amnesia-LaunchDaemon and macOS-Amnesia-TmpStagingDir to Prevent first — both are behaviorally distinctive to AmnesiaStealer with essentially no known legitimate collision.

Atomic indicators are from cited research and ready to import. The two IP addresses are single-sourced (GBHackers) — set to detect/validate rather than hard block. Domains and hashes carry higher confidence.

type,value,action,severity,expiration,description,tags
domain,debug.allllowef.space,block,critical,2027-02-16,AmnesiaStealer Amnesia Panel C2 root + exfil,campaign:amnesiastealer
domain,news.allllowef.space,block,high,2027-02-16,AmnesiaStealer related C2 infrastructure,campaign:amnesiastealer
domain,shlyapadulina.space,detect,medium,2026-11-16,AmnesiaStealer C2/delivery infra (single-sourced),campaign:amnesiastealer
domain,amz.shlyapadulina.space,detect,medium,2026-11-16,AmnesiaStealer C2/delivery infra (single-sourced),campaign:amnesiastealer
domain,github.aoitour.com,block,high,2027-02-16,AmnesiaStealer counterfeit GitHub ClickFix landing page,campaign:amnesiastealer
ipv4,138.124.70.84,detect,medium,2026-11-16,AmnesiaStealer C2 host (single-sourced-validate),campaign:amnesiastealer
ipv4,138.124.96.160,detect,medium,2026-11-16,AmnesiaStealer C2 host (single-sourced-validate),campaign:amnesiastealer
sha256,de5748aac4a4d4cb48cf050652679e6bc49eda33d9ffaa0d280b578122fab55a,prevent,critical,2027-02-16,AmnesiaStealer Stage 1 Rust infostealer binary,campaign:amnesiastealer
sha256,e853748ca8f9a5a9168263617409a9039ab09f4ffc7d860374c1e3b0b67b31a5,prevent,critical,2027-02-16,AmnesiaStealer Stage 2 stream_module binary,campaign:amnesiastealer

STAGE    /tmp/<25-random-alphanumeric-chars>/                       -> loot staging directory
STAGE    .../Browsers  .../Passwords  .../Wallets  .../Notes  .../Telegram  .../FileGrabber
STAGE    .../system_info.json  .../installed_apps.txt  .../collection_report.txt  .../pwd
CREDS    ~/.pwd                                                     -> cleartext harvested local password
PERSIST  /Library/LaunchDaemons/com.apple.ReportCrash.agent_<digits>.plist  -> root LaunchDaemon
DROPPER  /tmp/starter  /tmp/tempAppleScript.scpt                     -> Stage 0 staging / osascript fallback
CONFIG   XOR key 4mn3s1a_2o26!xK (analyst identification only, not a block target)
CONFIG   Archive password "dulin"; Safe Storage overwrite key pqz8N3vKxRmY2aLcQ

BEHAVIOR: Terminal/shell decodes long base64 blob (ClickFix bootstrap)               -> detect (Q1)
BEHAVIOR: xattr quarantine strip + ad-hoc codesign + protected-zip extraction        -> detect (Q2)
BEHAVIOR: 25-char /tmp staging dir with AmnesiaStealer artifact set                  -> detect (Q3)
BEHAVIOR: launchctl load of ReportCrash.agent_<digits> LaunchDaemon                  -> detect (Q4)
BEHAVIOR: mount_apfs -o nobrowse outside Time Machine (CVE-2020-9771)                -> detect (Q5)
BEHAVIOR: dscl authonly / security unlock-keychain credential harvest                -> detect (Q6)
BEHAVIOR: non-browser process reads Cookies/Login Data across multiple bundles       -> detect (Q7)
BEHAVIOR: DNS/network to Amnesia Panel domain family or published IPs                -> detect (Q8)
BEHAVIOR: Chromium spawned headless with --remote-debugging-port (CDP hijack)        -> hunt   (Q9)
BEHAVIOR: clipboard hijack of BTC/BCH/ETH/TRON/LTC/XMR/SOL/XRP/ATOM addresses        -> dormant, watch only (disabled in analyzed build)

CHECK  ls -la /Library/LaunchDaemons/ | grep -Ei "ReportCrash\.agent_[0-9]"
CHECK  test -f ~/.pwd && echo "AmnesiaStealer password store present"
CHECK  find /tmp -maxdepth 1 -type d -regex '.*/[A-Za-z0-9]\{25\}$'
LOG    log show --last 1d --predicate 'process == "mount_apfs"' | grep -i nobrowse
LOG    ps aux | grep -Ei "(chrome|brave|edge|arc).*(--headless|--remote-debugging-port)" | grep -v grep
KILL   (after evidence capture) sudo launchctl bootout system /Library/LaunchDaemons/com.apple.ReportCrash.agent_<digits>.plist

1 · Read-only sweep for AmnesiaStealer artifacts (Falcon RTR / MDM script)

Prerequisites: Falcon RTR read-only session or MDM custom-script deployment capability; no elevated privileges required for the checks below.
Reboot required: none.
Rollback: none required — this script only reads and prints; it makes no changes.

#!/bin/bash
# Run per-user context where possible. Read-only enumeration only.
echo "== LaunchDaemon check =="
ls -la /Library/LaunchDaemons/ 2>/dev/null | grep -Ei "ReportCrash\.agent_[0-9]"

echo "== Staging directory check =="
find /tmp -maxdepth 1 -type d -regex '.*/[A-Za-z0-9]\{25\}$' 2>/dev/null

echo "== Cleartext password store check =="
for ua in /Users/*; do
  [ -f "$ua/.pwd" ] && echo "PASSWORD STORE: $ua/.pwd"
done

echo "== Active CDP relay check =="
ps aux | grep -Ei "(chrome|brave|edge|arc|opera|vivaldi|chromium).*(--headless|--remote-debugging-port)" | grep -v grep

2 · Remove persistence & artifacts after evidence capture

Prerequisites: local admin/root (via Falcon RTR elevated session or MDM); Stage 1 evidence capture completed for the plist, staging directory, and any binaries under quarantine BEFORE this step runs.
Reboot required: no — launchctl bootout takes effect immediately without a reboot.
Rollback: if a legitimate host is misidentified, restore the quarantined plist and staging directory from the evidence copy and re-run sudo launchctl bootstrap system /Library/LaunchDaemons/<restored-plist>. Because the daemon is malicious in every confirmed case, rollback is expected to be rare — document the false-positive if it occurs.

# 1) Capture evidence FIRST (copy, do not move, to an evidence share):
sudo cp -R /Library/LaunchDaemons/com.apple.ReportCrash.agent_<digits>.plist /evidence/ 2>/dev/null
sudo cp -R /tmp/<25-char-staging-dir> /evidence/ 2>/dev/null

# 2) Unload and remove the malicious LaunchDaemon:
sudo launchctl bootout system /Library/LaunchDaemons/com.apple.ReportCrash.agent_<digits>.plist
sudo rm -f /Library/LaunchDaemons/com.apple.ReportCrash.agent_<digits>.plist

# 3) Remove staging directory and cleartext password stores:
rm -rf /tmp/<25-char-staging-dir>
rm -f ~/.pwd /tmp/pwd /tmp/starter /tmp/tempAppleScript.scpt

3 · Block Amnesia Panel C2 at the network edge

Prerequisites: access to the DNS sinkhole / secure-web-gateway policy console.
Reboot required: none — DNS/proxy policy changes apply on next resolution.
Rollback: remove the entries from the denylist; no endpoint-side change is made, so rollback is a simple policy revert with no residual state.

# DNS/proxy denylist (import via your control plane):
debug.allllowef.space
news.allllowef.space
github.aoitour.com
# Detect-and-validate (single-sourced, lower confidence — hunt before hard-blocking):
shlyapadulina.space
amz.shlyapadulina.space
138.124.70.84
138.124.96.160

Because C2 infrastructure for these campaigns typically rotates, treat the domain/IP list as a seed — rely on Q1–Q7 (which detect AmnesiaStealer's on-host behavior, not just its current infrastructure) to catch a re-infrastructured wave.

Coverage note: browser credential-store reads (Q7) and C2 exfil (Q8) are rated Partial because both overlap with legitimate software (backup agents, normal HTTPS traffic) — this pack catches them with reasonable fidelity but leans on the surrounding chain (staging dir → LaunchDaemon → credential harvest) for confirmation rather than alerting on either signal alone. The CDP live-hijack query (Q9) is Partial because the same command-line flags are used by legitimate browser-automation tooling; tune the exclusion list to your environment before promoting to Prevent. Clipboard hijacking (T1115) has no query because Jamf's analysis confirmed the module is present in the code but disabled in the observed build — shipping a query against inactive functionality would not fire and was deliberately omitted rather than fabricated; re-add coverage immediately if a future build is reported with it enabled.