Malware locks browser in kiosk mode to steal Google credentials

Researchers uncovered a campaign where the Amadey loader deploys an AutoIt script that launches victim browsers in kiosk mode on Google’s reauthentication page while disabling Escape/F11, coercing users to enter and save Google credentials; saved credentials are then stolen by the StealC information stealer. The report details the attack timeline (active since at least Aug 22, 2024), script snippets, user mitigation steps to exit kiosk mode, and guidance to run antivirus scans after rebooting in safe mode.