GhostProfile macOS Malware Clones Browser Profiles for Remote Access

A newly identified macOS malware named GhostProfile clones browser profiles to allow attackers to remotely control hidden instances of Chrome or Firefox. According to a report by GBHackers, this implant enables operators to browse the web using victims’ authenticated sessions without mirroring the victim’s screen. The threat was disclosed by Moonlock Lab on October 12 after researcher @malwrhunterteam shared a sample.

How does GhostProfile operate without showing the screen?

GhostProfile functions as a hidden-VNC implant that avoids exposing the desktop environment. Instead of mirroring the user’s active screen, the malware creates a disposable clone of the browser profile. This cloned instance carries the victim’s cookies and authentication state, allowing an attacker to interact with logged-in services silently. The activity remains concealed from the victim’s normal browser window.

View the original post on X

The researchers describe this as an interactive browser-control implant rather than a simple credential harvester. By retaining the authentication state copied from the victim’s browser, attackers can navigate websites while sessions remain valid. This design allows operators to perform actions that might otherwise require a password prompt, provided the cloned session is accepted by the target service.

What technologies enable this covert access?

The malware repurposes legitimate automation interfaces to achieve covert control. Specifically, GhostProfile reportedly uses the Chrome DevTools Protocol (CDP) and WebDriver BiDi. Mozilla’s documentation describes WebDriver BiDi as a bidirectional, WebSocket-based communication model that allows automation clients to receive browser events while issuing commands. This capability includes controlling browsing contexts, executing scripts, and monitoring network activity.

By leveraging these standard protocols, the malware establishes a control channel that is not immediately obvious to the user. The bidirectional nature of the communication allows the attacker to receive real-time feedback from the browser while issuing remote commands. This technical approach distinguishes GhostProfile from simpler tools that merely collect static credentials for later use.

Does this bypass all security protections?

The disclosure does not establish that every website will accept the cloned session. Success depends on the specific browser implementation, session handling, and service-side controls. Device-bound protections or additional authentication challenges may still block access, as the malware does not necessarily bypass all security layers. The effectiveness of the attack varies based on how individual services validate active sessions.

Starting with Chrome version 136, Google implemented a change that stops the browser from honoring remote debugging flags against its default data directory unless a nonstandard user data directory is supplied. Google states that using a separate directory employs a different encryption key, which protects existing Chrome data from this specific attack route. This change makes the profile-cloning technique technically significant but not universally effective.

What should users and administrators do?

No patch or fix has been confirmed yet for the GhostProfile malware itself. Users should monitor their systems for unusual browser behavior or unexpected network connections. Administrators should review logs for signs of unauthorized automation protocols or remote debugging activity. Once the vendor provides an update or detection signatures, organizations should deploy them immediately to mitigate exposure.

What to do and how to stay safe: GhostProfile

• Monitor system logs for unauthorized use of Chrome DevTools Protocol or WebDriver BiDi connections.
• Check for unknown or duplicate browser profile directories on macOS systems.
• Enable multi-factor authentication on critical accounts to reduce the value of stolen session cookies.
• Keep browsers updated to the latest versions to benefit from security hardening changes like those in Chrome 136.

Step-by-step guide: 7 Phishing Mistakes That Bypass Your Defenses

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is GhostProfile malware?

GhostProfile is a macOS implant that clones browser profiles to create hidden instances of Chrome or Firefox, allowing remote control of authenticated sessions.

Does it mirror the victim's screen?

No, it does not mirror the desktop; instead, it creates a disposable browser-profile clone that operates covertly without displaying activity in the normal window.

Is there a fix available?

No specific fix for the malware has been confirmed, but Chrome 136 includes changes that protect default data directories from remote debugging attacks.