GhostProfile macOS Malware Clones Browser Profiles to Hijack Live Sessions

A newly reported macOS malware called GhostProfile clones browser profiles and lets attackers control hidden copies of Chrome or Firefox using the victim’s active logins.

Rather than showing or copying the visible desktop, the malware creates a separate browser workspace where an operator can browse websites with cookies taken from the infected Mac.

The threat moves beyond collecting passwords for later use. By working inside a copied browser profile, an attacker may reach accounts whose sessions remain valid without another sign-in.

The victim’s normal browser can remain open while activity takes place elsewhere, making account misuse harder to notice through visible screen changes alone.

Researchers from Moonlock Lab identified the malware after receiving a sample shared by MalwareHunterTeam and disclosed their findings on October 12, 2026.

In its initial GhostProfile research thread, the team described the sample as apparently undetected at that point. That early observation does not establish universal antivirus evasion, and the researchers noted that the delivery script was already detectable.

GhostProfile macOS Malware Clones Browser Profiles

Traditional hidden Virtual Network Computing, or hVNC, malware usually creates a concealed desktop. GhostProfile instead builds a temporary browser-profile clone and controls it through Chrome DevTools Protocol, known as CDP, and WebDriver BiDi.

These browser interfaces give the operator a way to interact with pages while using the copied login state. The approach resembles techniques covered in AmnesiaStealer hidden browser control, where a second-stage component copies browser profiles and operates a concealed Chromium session.

The shared concern is live account access rather than password theft alone. However, similar behavior does not establish that GhostProfile and AmnesiaStealer share developers, infrastructure, or an underlying codebase.

To conceal its browser window, GhostProfile moves it to screen coordinates far outside the visible display. It also changes the browser’s automation flag and spoofs WebGL and plugin information.

These changes appear intended to make automated browsing less obvious to websites, although Moonlock’s disclosure does not demonstrate that every site accepts the disguise.

The operator receives JPEG screenshots and can send simulated mouse clicks and keyboard input. Moonlock also reported that the implant grants its controlled browser permissions for camera, microphone, location, notifications, and clipboard access.

Those capabilities widen the potential impact, but the disclosure does not show that operators used every permission against victims.

Delivery, Persistence, and Data Theft

The infection chain begins with a short shell command that passes downloaded content into the zsh shell. Its delivery script fetches the agent, removes its quarantine marker, places the payload in the Downloads folder, and registers a fake system-updater LaunchAgent. RunAtLoad and KeepAlive settings support automatic startup and continued operation.

This disguise follows a familiar pattern in fake updater persistence attacks, where malware borrows trusted software names to hide startup entries.

GhostProfile’s reported updater identity should therefore be checked against its file location and behavior, rather than accepted as legitimate simply because the name sounds like a system component.

GhostProfile focuses on Chromium-family browsers and Firefox, the browser types it can control. It examines cookie stores using SQLite tools and reads the system clipboard through the macOS NSPasteboard interface.

The agent also contains a readable hVNC banner, a default pre-shared key, and temporary working directories that it removes on exit.

An additional upload-and-run function makes the implant a loader. An operator can send a ZIP archive or disk image, after which the agent extracts or mounts it, finds an application, clears quarantine, and launches it.

This creates a route for additional payloads, although Moonlock did not identify a confirmed follow-on malware family. The broader risk matches Odyssey Stealer browser theft, where stolen cookies can expose accounts without immediately revealing their passwords.

GhostProfile adds direct interaction with a concealed browser. Still, its reported cloning capability should not be treated as proof that every session remains usable or that all additional authentication checks can be bypassed.

Security teams should investigate unexpected browser-profile copies, hidden browser launches, unfamiliar updater LaunchAgents, and connections to the reported infrastructure.

Suspected Macs should be isolated while evidence is preserved. Account recovery should include revoking exposed sessions and changing credentials from a trusted device, rather than relying on a password reset alone to end ongoing access.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post GhostProfile macOS Malware Clones Browser Profiles to Hijack Live Sessions appeared first on Cyber Security News.