Fake GitHub download turns Safari & Chrome into a Keychain data stealer

Jamf Threat Labs has found . The attack begins on a counterfeit GitHub page that tells visitors to paste a command into Terminal.

AmnesiaStealer then displays a fraudulent installer prompt and uses the captured Mac login password to reach Keychain, browser data, Apple Notes, Telegram sessions, and personal files.

The attack doesn't rely on an unknown | Discuss on our Forums