Multi-factor authentication significantly improves account security, but attackers are increasingly targeting authenticated sessions after login has already taken place.
AmnesiaStealer, a macOS information-stealing malware, has been observed targeting passwords, keychain information, documents and active application sessions.
The malware can also clone Chromium browser profiles, potentially allowing an attacker to interact with websites through an already authenticated user session.
This is particularly important for Kenyan organisations using cloud email, online banking, administrative portals and other browser-based services.
Following a confirmed endpoint compromise, organisations should clean the affected device, revoke active sessions, rotate exposed credentials and require the user to authenticate again.
Users should also be cautious when websites instruct them to copy commands into Terminal or other system tools as part of supposed verification or troubleshooting.
Protecting accounts requires securing both the login process and the authenticated session that follows.