MDR
Solutions
Partners
About
Resources
CVE-2020-9771
August 17, 2026
AmnesiaStealer is a Rust-based macOS infostealer distributed through ClickFix-style social engineering, designed to steal credentials, browser data, keychain material, cloud and crypto assets, and hijack authenticated browser sessions.
macOS endpoints, particularly systems using Chromium-based browsers, Apple Keychain, Safari, Telegram, cryptocurrency wallet extensions, and devices with excessive Full Disk Access privileges.
Successful infection enables credential theft, keychain and browser-data compromise, cryptocurrency wallet theft, persistent access, and live hijacking of authenticated browser sessions across services such as email, banking, cloud storage, and SSO-enabled SaaS.
The campaign relies primarily on social engineering rather than a software vulnerability, tricking users into executing an encoded shell command and supplying their macOS password. Legacy TCC bypass attempts linked to CVE-2020-9771 are also present.
/tmp, apply least-privilege Full Disk Access, and train users never to paste untrusted Terminal commands from websites.Our security experts can help you assess affected systems, validate risk and support a safe remediation plan.
Discuss Your Security ExposureExplore Incident ResponseAssess your risk
Identify affected systems
Plan remediation
Practical, vendor-aligned guidance
Get expert support
From our 24/7 security team
Get the latest threat intelligence and security advisories from Smarttech247.
View All Threat UpdatesDownload the complete analysis, including detailed technical findings and references.
Jamf Threat Labs
SecurityWeek
BleepingComputer
GBHackers
SC Media
CybersecurityNews
MacTech
.jpg)