Key points
- GhostProfile clones Chrome and Firefox profiles to access authenticated sessions remotely.
- The malware controls hidden browsers via DevTools and WebDriver BiDi protocols.
- Chrome 136 changes how it handles remote debugging flags, impacting this attack vector.
GhostProfile is a newly reported macOS implant that clones browser profiles to allow attackers to operate concealed copies of Chrome or Firefox. According to GBHackers, the malware enables remote operators to browse using victims’ authenticated sessions. It functions as a hidden-VNC implant but does not mirror the victim’s screen. Instead, it creates a disposable browser-profile clone.
In plain English
The malware does not simply steal passwords. It copies the entire browser profile, including active cookies and login states. Moonlock Lab disclosed that this "ghost" browser allows an operator to interact with logged-in services. The activity does not appear in the victim’s normal browser window. This means accounts can be accessed while existing sessions remain valid.
View the original post on X
The background
Researchers from Moonlock Lab identified GhostProfile after receiving a sample from malware researcher @malwrhunterteam. They disclosed their findings on October 12. The malware controls the cloned browser through Chrome DevTools Protocol and WebDriver BiDi. These are legitimate automation interfaces. Mozilla describes WebDriver BiDi as allowing control over browsing contexts and page elements. GhostProfile repurposes this for covert access.
What changes now
To hide its activity, GhostProfile moves the browser window to screen coordinates far outside the visible display. It also changes the browser’s automation flag and spoofs WebGL information. The operator receives JPEG screenshots and can send simulated mouse clicks and keyboard input. The delivery script was already detectable at the time of disclosure, according to Cyber Security News.
Who needs to act first
Teams should prioritize systems that store critical financial or administrative credentials. Verify whether any Macs in the environment are running vulnerable browser configurations. Test detection rules against the known delivery script before full deployment. Back up important browser data before making changes. If no patch is available, isolate affected machines from sensitive networks immediately. Monitor for unusual outbound traffic patterns that might indicate hidden browser sessions.
What to do and how to stay safe: GhostProfile
- Check for unauthorized processes running Chrome or Firefox in the background.
- Verify that browser automation flags are not being spoofed by checking system logs.
- Ensure all Macs are updated to the latest browser versions available.
- Monitor network traffic for unexpected JPEG streams or WebSocket connections.
Step-by-step guide: Phishing Risks and Protection for Small Business Operations
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does GhostProfile mirror the victim’s screen?
No, according to GBHackers, it is described as a hidden-VNC implant that does not mirror the victim’s screen.
Which browsers are affected by GhostProfile?
The malware reportedly clones profiles for Chrome and Firefox, allowing remote control of these browsers.
Is there a patch for this vulnerability?
No fix has been confirmed yet, but Chrome 136 includes changes to remote debugging flags that may mitigate the attack.
