GhostProfile Mac Implant Uses Cloned Profiles for Hidden Browser Control
A new macOS malware creates invisible browser instances to hijack active web sessions, bypassing traditional screen-sharing detection methods.
Key points
- GhostProfile clones Chrome or Firefox profiles to operate concealed browser sessions using victims' live authentication cookies.
- The implant uses CDP and WebDriver BiDi to control the hidden browser without mirroring the user's visible desktop.
- Researchers from Moonlock Lab disclosed the threat on October 12 after receiving a sample from MalwareHunterTeam.
GhostProfile is a macOS implant that clones browser profiles to establish hidden, interactive sessions for remote attackers. Rather than displaying the user's screen, the malware creates disposable copies of Chrome or Firefox profiles. This allows operators to navigate web services using the victim's existing authentication state without triggering visual alerts on the infected machine.
Root cause
The malware exploits legitimate browser automation interfaces to maintain covert access. According to Moonlock Lab's disclosure, GhostProfile controls these hidden instances through the Chrome DevTools Protocol and WebDriver BiDi. These protocols allow external commands to manipulate browsing contexts, execute scripts, and interact with page elements. By repurposing these tools, the implant retains session validity copied from the victim's primary browser.
View the original post on X
Attack path
Operators receive JPEG screenshots of the hidden browser and can send simulated input. To evade detection, GhostProfile moves the browser window to coordinates outside the visible display area. It also modifies automation flags and spoofs WebGL and plugin information to appear as normal browsing. This approach differs from credential stealers by enabling real-time interaction with logged-in services, potentially bypassing password prompts if sessions remain active.
Affected versions
- macOS systems running Google Chrome or Mozilla Firefox.
- The disclosure notes that starting with Chrome 136, the browser restricts remote debugging unless a nonstandard user data directory is specified.
- This change in Chrome 136 uses separate encryption keys, which may protect existing data from this specific cloning route.
Mitigation
- Monitor for unauthorized processes accessing browser profile directories or devtools protocols.
- Review network traffic for unexpected WebSocket connections associated with browser automation.
- Verify that browser security settings restrict remote debugging ports on default data directories.
- Implement session monitoring to detect anomalous activity from cloned profiles.
What to do and how to stay safe: GhostProfile
- Check your organization's endpoint detection rules for processes spawning hidden browser instances or modifying window coordinates.
- Review browser security configurations to ensure remote debugging interfaces are disabled or restricted to non-default directories.
- Monitor web application logs for sessions accessing resources from unexpected user-agent strings or automation flags.
- Once the vendor provides an update, apply patches that address browser profile isolation and automation flag spoofing.
Step-by-step guide: Phishing Defenses: Answers to 10 Critical Questions
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does GhostProfile steal passwords directly?
No, the malware clones browser profiles to use existing authentication cookies, allowing access without capturing passwords.
Is this malware currently being actively abused?
The source material reports the malware was disclosed by researchers but does not confirm active widespread abuse or specific victim counts.
Can antivirus software detect GhostProfile?
Moonlock Lab noted the sample was initially undetected, but the delivery script was already detectable at the time of disclosure.
