Anomali Cyber Watch: AmnesiaStealer - Credential Theft Meets Live Browser Hijacking on macOS, Akira Ransomware Deploys Safe Mode to Evade Detection, but Encryption Fails, and more

New macOS malware family AmnesiaStealer combines credential theft with live remote control of a victim's browser. The malware spreads through a ClickFix campaign that presents a counterfeit GitHub download page and instructs visitors to paste a Terminal command, which downloads and runs a dropper script that in turn retrieves a password protected archive containing the payload. Once running, it profiles the host, captures the login password through a disguised system prompt, and uses that password to unlock the macOS Keychain, the system's store for saved credentials. It then collects Apple Notes, Telegram session data, documents, and profile data from 16 Chromium based browsers. On macOS 26 and later, when it cannot recover a browser's existing Safe Storage key, it deletes and replaces the corresponding keychain entry with an attacker chosen value, permanently rendering previously saved passwords and cookies undecryptable while letting the attacker decrypt data collected afterward. An older technique for reaching Safari cookies and the TCC database through an APFS snapshot mount failed in testing, blocked by a missing Full Disk Access grant and by system level protection respectively. On a follow up command, a second component clones the victim's browser profile into a hidden background browser for seven Chromium based browsers, streaming the session at roughly three frames per second while giving the operator live control over mouse, keyboard, and navigation, and extracting decrypted cookies through the Chrome DevTools Protocol.

Source

Analyst Comment

The capability worth tracking here is the shift from one time data collection to live, operator driven use of an already authenticated browser session. This can allow access to persist despite a password change where existing sessions are not simultaneously invalidated, reinforcing the importance of explicit session revocation during containment. In the campaign observed by researchers, initial execution depends on a user pasting a Terminal command, so endpoint detection and user awareness matter alongside normal patch management. Defenders should prioritize detection around Safe Storage keychain entries being deleted and recreated through the security command line, LaunchDaemons mimicking Apple crash reporting, headless Chromium processes launched with remote debugging flags, and outbound WebSocket connections to unfamiliar relay hosts. On macOS 26 and later, the malware's TCC bypass attempts failed in initial testing, though its APFS snapshot technique still worked when the responsible process already held Full Disk Access, making that permission worth auditing rather than assuming macOS protections alone will prevent access. Training users to recognize unexpected instructions to paste commands into Terminal directly addresses the social engineering technique used in the observed campaign.

An Akira ransomware affiliate compromised a network through a SonicWall SSL VPN account that lacked multi-factor authentication (MFA), succeeding roughly seven minutes after a credential spray began. Using Remote Desktop Protocol, the attacker reached the domain controller and ran a full enumeration of Active Directory, collecting details on every user and computer in the environment. They then archived data from file shares using WinRAR and uploaded it to attacker-controlled cloud storage with the transfer tool s5cmd. Access and remote control were maintained through AnyDesk, a legitimate remote-management tool repurposed here to deliver the ransomware payload. Roughly two and a half hours into the intrusion, the attacker forced the machine to reboot into Safe Mode with Networking, a limited startup mode that disabled both the endpoint detection and response (EDR) agent and Microsoft Defender's real-time protection. Seconds after the ransomware's process activity began, the host suffered virtual-memory exhaustion and the encryption attempt failed. Researchers assess that Safe Mode's constrained environment likely contributed to this outcome. Data had already been exfiltrated before the failure, preserving the attacker's leverage for extortion. Researchers describe the failure as a side effect of memory constraints in this environment, not a reliable defense against Akira ransomware more broadly.

Source

Analyst Comment

The value of this incident lies less in the failed encryption and more in what it reveals about detection gaps. Safe Mode Boot abuse is a documented technique across several ransomware families, including Snatch, AvosLocker, and Black Basta, so this incident reflects established ransomware tradecraft appearing in Akira affiliate activity rather than a novel technique. Whether this becomes standard Akira practice or reflects a single affiliate's experimentation remains unclear from current evidence, and analysts should avoid treating one intrusion as a confirmed trend. The more urgent point for defenders is that encryption failure did not eliminate the attacker's leverage. Credentials and file share data were already exfiltrated before the Safe Mode reboot occurred, preserving extortion pressure regardless of whether files were locked. Organizations should treat Safe Mode boot events, msconfig or bcdedit activity, and unexpected security service shutdowns as high priority alerts warranting investigation. Enforcing MFA across all VPN accounts remains a critical defense against this intrusion path, as the attacker gained access through a valid account on an SSL VPN that lacked it. Defenders should not read the encryption failure as a sign this technique carries inherent risk to attackers going forward.

DeadLock is a ransomware operation first observed in July 2025 that steals data and encrypts victim systems, then threatens to publish the stolen files unless a ransom is paid, a technique known as double extortion. As of July 2026, its leak site listed more than 80 victims, over half in Europe, with others across Asia, North America, South America, and Africa, in sectors including IT, mining, transportation and logistics, manufacturing, hospitality, and consumer goods. Researchers observed the malware deployed by multiple groups, including an affiliate linked to the Lynx and INC ransomware ecosystems. Its recovery infrastructure sets it apart: rather than a fixed chat proxy address, the victim-facing recovery application retrieves the current proxy address from a Polygon blockchain smart contract, relays communications through that proxy into the decentralized Session messaging network, and links to stolen files hosted on Wasabi cloud storage. Operators can change the proxy without redistributing the recovery application, making parts of the operation harder to disrupt, though not immune, since the proxy can be disabled, Polygon RPC access can be blocked, and Wasabi-hosted files can be removed. The malware uses unique per-file encryption keys and avoids systems in former Soviet, CIS-linked, and select Middle Eastern countries.

Source

Analyst Comment

DeadLock's blockchain layer matters most for its negotiation and leak site infrastructure, allowing operators to rotate proxy addresses without redistributing victim-facing files or updating a hard-coded proxy address. For a typical SOC, this changes relatively little day to day. Prevention still hinges on disrupting initial access and lateral movement before an intrusion reaches the ransomware and extortion stage. Endpoint hardening, tamper protection, EDR in block mode, and attack surface reduction rules against PsExec and WMI abuse remain central defensive measures, consistent with Microsoft's layered guidance. Reporting attributed to ReliaQuest recommends monitoring outbound traffic from servers or non developer endpoints to public Polygon RPC providers alongside unusual Session activity, though this is secondary reporting rather than Microsoft's own analysis and should be treated as a supplementary hunting opportunity rather than a standalone indicator of malicious activity. That same reporting notes Cry0 ransomware has used the Internet Computer Protocol blockchain for negotiations, a narrower implementation than DeadLock's Polygon based proxy rotation, hinting this approach may not stay isolated to one operation. Analysts should track the groups deploying DeadLock and how its leak site activity develops, since January 2026 reporting described a notably lower profile operation with no known affiliate program or public leak site.

Security researcher Chaotic Eclipse, also known as MSNightmare and Nightmare-Eclipse, publicly released full source code and a proof-of-concept (PoC) for ShieldBreak, a local privilege escalation exploit targeting Microsoft Defender that the researcher claims bypasses the patch for CVE-2026-50656 (RoguePlanet), rated CVSS 7.8. Microsoft patched RoguePlanet in Malware Protection Engine version 1.1.26060.3008 on July 9, 2026. ShieldBreak registers a directory as a Windows Cloud Files sync root and plants an EICAR test file to trigger a Defender scan. A user-mode callback hook intercepts the scan's cloud-hydration process via the Cloud Filter API; Object Manager symlinks redirect Defender's scan path to System32, and the Common Log File System (CLFS) swaps the hydration data to place an attacker-controlled phoneinfo.dll into C:\Windows\System32. The Windows Error Reporting library explicitly loads phoneinfo.dll when present, so the exploit then invokes the QueueReporting scheduled task, which runs the Windows Error Reporting manager with highest privileges, loading the DLL and spawning a SYSTEM-level shell. Security researcher Kevin Beaumont confirmed the exploit works and noted the mechanism differs from RoguePlanet; Will Dormann, principal vulnerability analyst at Tharros Labs, independently reproduced it and assessed that Defender must be active for the exploit to function, which RoguePlanet did not require. Whether ShieldBreak constitutes a true patch bypass or a distinct technique reaching the same outcome remains analytically disputed. Microsoft stated it is investigating the report's validity. No CVE has been assigned and no patch is available.

Source

Analyst Comment

ShieldBreak requires an attacker to already have user-level code execution on the target system, placing it in the post-exploitation phase. Ransomware operators and hands-on-keyboard intrusion sets are the threat actors most likely to operationalize this, as privilege escalation after initial access is a documented step in those workflows; prior tools from this researcher have been confirmed incorporated into live attack chains, which increases the credibility of near-term weaponization. The full source code is publicly available and compilable, which lowers the barrier beyond sophisticated actors alone. Organizations running a third-party endpoint product should not assume they are out of scope: Windows typically places Defender in passive mode rather than disabling it when a third-party product is present, and whether ShieldBreak functions in passive mode has not been formally tested. An interim file-based mitigation is available: placing a 0-byte phoneinfo.dll in C:\Windows\System32 causes the exploit to exit at startup, as the source code explicitly checks for the file's presence before proceeding. This workaround should be tested on a small group before broad deployment as it may cause unwanted side effects. The exploit chain is entirely local with no network-based indicators of compromise, meaning detection relies exclusively on host-based behavioral signals: anomalous Cloud Files sync root registration, CLFS activity, unexpected DLL writes to System32, and unusual invocation of the QueueReporting scheduled task. Beaumont's detection queries target MDE Custom Detections and Advanced Hunting natively; Sentinel deployments require the Defender XDR data connector to be active and ingesting before these queries will function. CLFS has featured in multiple confirmed ransomware campaigns since 2022, so mature environments should already carry some detection coverage here. In the absence of a vendor patch, the phoneinfo.dll placeholder and host-based behavioral detection are the primary controls available.

Zoom has patched three vulnerabilities in its annotation feature, the most significant of which is CVE-2026-53413, a buffer overwrite flaw that Zoom rates High severity at CVSS 8.3. Researcher analysis assessed it as exploitable without victim interaction, though Zoom's published CVSS vector encodes user interaction as required, and no exploitation has been reported as of publication. The flaw resides in the annotation protocol's deserialization logic, where attacker-controlled character counts are copied into fixed 128-byte buffers without bounds validation, allowing adjacent memory to be overwritten and program execution redirected. Post-exploitation capabilities documented by researchers include data theft, camera and microphone activation, and malware installation. CVE-2026-53414, a buffer overread in the same engine, may expose heap memory containing code pointers per researcher analysis; Zoom's bulletin scores its confidentiality impact as none. CVE-2026-53415, a use-after-free in auto-shape message handling, was independently identified by Zoom's internal team before external researchers reported it. Affected products include Zoom Workplace, Zoom Workplace VDI Client for Windows, Zoom Rooms, Zoom Meeting SDK, and Zoom Video SDK. Fixed versions vary by product branch; consult bulletins ZSB-26015, ZSB-26016, and ZSB-26017 for applicable requirements.

Source

Analyst Comment

CVE-2026-53413 is patched and no active exploitation has been reported, but remediation is more complex than a single client update. Zoom's August 11 release addressed four CVEs across four bulletins, and organizations need to verify coverage across each product line separately. The annotation vulnerabilities (ZSB-26015, ZSB-26016, ZSB-26017) affect Zoom Workplace, Zoom Workplace VDI Client for Windows, Zoom Rooms, Zoom Meeting SDK, and Zoom Video SDK, each with its own fixed version requirement. A fourth bulletin (ZSB-26018) covers CVE-2026-53416, a path traversal flaw also affecting the VDI Client rated CVSS 7.1, with distinct fix versions for both the client and VDI plugins. VDI deployments require patching against both sets of requirements. Zoom's server-side filter blocks malicious annotation messages for clients running enhanced encryption, Zoom's default setting, but does not apply to end-to-end encrypted meetings. E2EE requires explicit opt-in and this gap is likely narrow for most enterprises, but organizations that have enabled it should treat client patching as the only complete fix. The researcher assessment that this class of exploit now requires significantly less effort to produce against closed-source software is self-reported and not independently verified. The working exploit itself is documented, and the implication for defenders holds regardless: software that has never been externally reviewed may carry comparable vulnerabilities, and complexity is not a reliable substitute for scrutiny.

A multi-agent artificial intelligence (AI) framework conducted 12 attack waves against government entities in Asia over four days in early July 2026, producing 1,395 files and achieving confirmed compromises. Built on the publicly available Hermes and OpenClaw agentic frameworks, the toolkit deployed up to eight sub-agents concurrently in a near-autonomous operation, each assigned distinct targets and techniques. Initial access came through three vectors: unauthenticated debug endpoints in production, credential spraying using optical character recognition (OCR) to solve CAPTCHA challenges and crack 85 accounts, and a JSON Web Token (JWT) bypass accepting tokens with the algorithm set to none. Eighty-four of 85 cracked accounts pivoted to connected systems via Single Sign-On (SSO), which extended trust automatically without additional authentication. The framework exfiltrated 2,564 personnel records and database credentials before expanding to a nuclear safety agency, a government email system, and at least seven energy companies. A two-layer Bayesian scoring engine continuously reprioritized 14 parallel attack chains; five structured learning cycles searched vulnerability databases and repositories for target-applicable techniques. Safety guardrails were bypassed by framing activity as authorized penetration testing; linguistic analysis points to a Chinese-language operator. Multiple credible outlets identify Taiwan as the target; the researchers have not confirmed this.

Source

Analyst Comment

This is the first publicly documented case of a near-autonomous multi-agent AI framework achieving verified government compromise, reflecting what is confirmed rather than when this capability first appeared or how widely it may operate undetected. Every confirmed access path exploited known, preventable misconfigurations: debug endpoints in production, an unsigned JWT bypass, and SSO extending trust without re-authentication. These classes have been documented for years. What changed is the economics of finding and chaining them at scale without sustained human involvement. Organizations deprioritizing these fixes should reassess. The framework's learning cycles searched vulnerability databases mid-operation, a documented capability to incorporate newly available research against a live target. The broader CVE disclosure-to-exploitation window has compressed significantly; weekly or monthly patch cycles may not be adequate for network-accessible systems. Detection requires cross-system session correlation rather than rate-based thresholds, an approach that assumes logging maturity many organizations lack. Linguistic evidence points to a Chinese-language operator; multiple credible outlets identify Taiwan as the target; neither confirmed by researchers. If this is the first publicly documented case, the more important question is what has not yet been documented.