New macOS Malware Clones Chrome Profiles and Browses With Victims’ Live Logins

A newly reported macOS implant tracked as GhostProfile clones browser profiles and remotely operates concealed copies of Chrome or Firefox, allowing attackers to browse using victims’ authenticated sessions.

The researchers described it as a hidden-VNC implant that does not mirror the victim’s screen.

Instead of exposing the desktop, GhostProfile reportedly creates a disposable browser-profile clone and controls the resulting browser through Chrome DevTools Protocol (CDP) and WebDriver BiDi.

According to Moonlock’s supplied disclosure, this “ghost” browser carries the victim’s cookies, enabling an operator to interact with logged-in services without displaying the activity in the victim’s normal browser window.

The distinction matters: GhostProfile is described as an interactive browser-control implant, rather than merely a tool that collects credentials for later use.

Its reported design gives attackers an environment in which they can navigate websites while retaining authentication state copied from the victim’s browser. Moonlock’s initial description specifically emphasizes live logins and profile cloning.

This could expose accounts whose existing sessions remain valid without another password prompt.

However, the disclosure does not establish that every website accepts the cloned session, that device-bound protections are bypassed, or that additional authentication challenges disappear.

Those outcomes depend on the browser, session implementation, and service-side controls.

The underlying protocols are legitimate automation interfaces. Mozilla’s WebDriver BiDi documentation describes capabilities for controlling browsing contexts, executing scripts, interacting with page elements, and monitoring network activity.

Its bidirectional, WebSocket-based communication lets an automation client receive browser events while issuing commands. GhostProfile reportedly repurposes that control model for covert access.

Moonlock Lab disclosed the malware, on October 12 after receiving a sample shared by malware researcher @malwrhunterteam.

Google previously documented attackers abusing remote debugging to extract cookies.

macOS Malware Hijacks Chrome

Starting with Chrome 136, the browser stopped honoring --remote-debugging-port and --remote-debugging-pipe against its default data directory unless a nonstandard --user-data-dir is supplied.

Google says that separate directory uses a different encryption key, protecting existing Chrome data from this attack route.

That change makes GhostProfile’s profile-cloning claim technically significant, but not self-explanatory.

The available disclosure does not show how the implant preserves usable authentication material across browser versions or interacts with encryption safeguards.

Cloning a directory alone should not be presented as proof that Chrome’s protections have been defeated.

Related SpecterOps research describes a separate Windows post-exploitation technique that enables CDP inside a running Chrome or Edge process.

That work illustrates the broader danger of browser-control interfaces after endpoint compromise, but it does not establish GhostProfile’s implementation or connect the two operations.

Moonlock said the sample “seems FUD for now,” an apparent reference to being fully undetected. That is a preliminary observation, not evidence of universal antivirus evasion or a durable ability to bypass endpoint defenses.

The accessible initial report does not provide a detection denominator, testing methodology, or evidence supporting broader claims.

The supplied disclosure also leaves the delivery mechanism, persistence, command-and-control infrastructure, victim scope, and attribution unresolved. No hashes or network indicators appear in the provided excerpts.

GhostProfile’s reported innovation is therefore specific: covertly operating a cloned, authenticated browser rather than mirroring an ordinary desktop.

Further sample analysis is needed to establish its implementation, reliability, and operational reach beyond that initial description of this newly reported macOS implant.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.