GhostProfile macOS Malware Hijacks Browser Sessions via Profile Cloning

Key Takeaways

• A new macOS malware, dubbed GhostProfile, has been discovered that hijacks browser sessions.
• The threat clones existing Chrome and Firefox profiles, allowing attackers to operate hidden browser instances with active user logins.
• GhostProfile facilitates live account access without requiring new authentication or direct password theft.
• The malware establishes persistence through a fake system-updater LaunchAgent.
• No immediate patch is available, requiring vigilance and proactive security measures from users and organizations.

GhostProfile: A New macOS Threat Hijacks Browser Sessions via Profile Cloning

A novel macOS malware, identified as GhostProfile, has emerged, capable of hijacking active browser sessions by creating cloned profiles of Google Chrome and Mozilla Firefox. This sophisticated threat enables attackers to surreptitiously control hidden browser instances, leveraging a victim’s live login credentials to access web services without requiring re-authentication.

Unlike traditional remote access tools that mirror the user’s visible desktop, GhostProfile establishes a separate, concealed browser environment. Within this hidden workspace, an operator can navigate websites using the victim’s existing session cookies, effectively bypassing typical login procedures and multi-factor authentication if a session remains valid. This method allows malicious activity to occur without visible changes on the victim’s screen, making detection through visual cues significantly more challenging.

Researchers from Moonlock Lab identified this malware after receiving a sample from @malwrhunterteam. Their findings were publicly disclosed on October 12, 2026. At the time of their initial analysis, the malware sample itself appeared to be largely undetected by antivirus solutions, though the researchers noted that the associated delivery script was already being flagged. This early observation does not guarantee universal evasion but highlights its stealth capabilities.

Browser Profile Cloning and Control Mechanisms

While conventional hidden Virtual Network Computing (hVNC) malware typically creates a covert desktop interface, GhostProfile employs a distinct strategy. It constructs a temporary, cloned browser profile and manipulates it using the Chrome DevTools Protocol (CDP) and WebDriver BiDi. These browser interfaces provide the attacker with direct interaction capabilities, allowing them to browse and interact with web pages while leveraging the copied, authenticated session state. This technique bears a resemblance to methods observed in AmnesiaStealer, another threat that utilizes hidden browser control by copying profiles and operating concealed Chromium sessions.

The primary concern with these methods is the ability for live account access, extending beyond mere credential harvesting. However, despite functional similarities, no direct link has been established between GhostProfile and AmnesiaStealer regarding shared developers, infrastructure, or underlying codebases. The focus remains on the operational threat posed by GhostProfile’s unique approach to session hijacking.

pic.twitter.com/7YZSG9XkwZ

To maintain its clandestine operations, GhostProfile positions the hidden browser window at screen coordinates far outside the visible display area. It also modifies the browser’s automation flag and spoofs WebGL and plugin information. These measures are designed to obscure the automated nature of the browsing activity from websites, although Moonlock’s report does not confirm the universal effectiveness of these evasion tactics across all web platforms.

Attackers receive JPEG screenshots of the hidden browser’s activity and can send simulated mouse clicks and keyboard inputs. Furthermore, Moonlock Lab reported that the implant grants its controlled browser instances broad permissions, including access to the camera, microphone, location services, notifications, and the system clipboard. While these capabilities significantly expand the potential for malicious activities, the disclosure did not confirm the active exploitation of every permission against victims.

Infection Chain, Persistence, and Data Exfiltration

The GhostProfile infection process initiates with a concise shell command that pipes downloaded content into the zsh shell. This delivery script subsequently fetches the main agent, removes its macOS quarantine attribute, places the payload within the Downloads directory (specifically, ~/Downloads/wohnung), and then registers a deceptive system-updater LaunchAgent. The use of RunAtLoad and KeepAlive settings within this LaunchAgent ensures the malware’s automatic startup and continuous operation, providing robust persistence.

This tactic of masquerading as a system updater is a common persistence mechanism in malware, leveraging trusted system component names to conceal malicious startup entries. Consequently, any detected “system updater” LaunchAgent should be rigorously verified against its actual file location and behavior, rather than being accepted as legitimate based solely on its name.

GhostProfile primarily targets Chromium-based browsers and Firefox, leveraging SQLite tools to examine cookie stores and the macOS NSPasteboard interface to read clipboard data. The agent also contains a readable hVNC banner, a default pre-shared key, and creates temporary working directories that are deleted upon exit.

Beyond its session hijacking capabilities, GhostProfile functions as a loader. It includes an upload-and-run feature, enabling operators to transmit ZIP archives or disk images. The agent can then extract or mount these, locate an application, clear its quarantine flag, and launch it. This mechanism provides a pathway for deploying additional payloads, though Moonlock did not identify any specific follow-on malware families associated with the observed samples. This broader risk profile aligns with threats like Odyssey Stealer, where stolen cookies can compromise accounts without direct password exposure. GhostProfile elevates this risk by adding direct, interactive control over a concealed browser session. However, its cloning capability should not be interpreted as a guarantee that every session will remain usable or that all multi-factor authentication checks can be universally bypassed.

What You Should Do

• Monitor for Anomalous Browser Activity: Regularly check for unexpected browser profile copies, hidden browser launches, or any unfamiliar LaunchAgents masquerading as system updates.
• Review LaunchAgents: Scrutinize all LaunchAgents, especially those with names resembling system components (e.g., com.system.updater), verifying their legitimacy against known system files and expected behavior.
• Isolate Compromised Systems: Immediately isolate any suspected macOS devices to prevent further lateral movement and preserve forensic evidence.
• Revoke Sessions and Change Credentials: For any accounts potentially compromised, revoke all active sessions and change passwords from a known trusted device. Do not rely solely on a password reset.
• Implement Endpoint Detection and Response (EDR): Utilize EDR solutions to detect and respond to suspicious processes, file modifications, and network connections indicative of malware activity.
• Stay Informed: Keep abreast of the latest threat intelligence and security advisories, particularly regarding #macOS #malware.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.