GhostProfile macOS Malware Spawns Invisible Browsers via DevTools to Evade Screen Mirroring

GhostProfile, a newly disclosed macOS implant, enables remote operators to control concealed copies of Chrome or Firefox browsers using victims’ authenticated sessions. According to Moonlock Lab, the malware functions as a hidden Virtual Network Computing tool that avoids traditional screen mirroring. Instead of exposing the desktop, it creates disposable browser-profile clones, allowing attackers to navigate websites while retaining the victim’s login state and cookies.

Root cause

The threat leverages legitimate automation interfaces to establish covert access. Researchers describe the implant as repurposing Mozilla’s WebDriver BiDi and the Chrome DevTools Protocol. These standard protocols allow automation clients to control browsing contexts, execute scripts, and monitor network activity via bidirectional WebSocket communication. GhostProfile exploits these capabilities to issue commands and receive events, effectively turning the browser into a remote-controlled application without displaying the window to the user.

View the original post on X

Attack path

Operators interact with the cloned browser through simulated mouse clicks and keyboard input, receiving JPEG screenshots as feedback. To evade detection, the malware moves the browser window to coordinates outside the visible display area. It also modifies the browser’s automation flag and spoofs WebGL and plugin information. This disguise aims to make the automated browsing appear legitimate to websites, though Moonlock notes that not all services may accept such camouflage or bypass device-bound protections.

Affected versions

The disclosure highlights technical significance regarding Chrome version 136. Starting with this release, Chrome stopped honoring remote-debugging flags against its default data directory unless a non-standard user-data directory is supplied. Google states that using a separate directory employs a different encryption key, protecting existing Chrome data from this specific attack route. GhostProfile’s ability to clone profiles remains relevant for earlier versions or configurations where these safeguards are not fully enforced.

Mitigation

• Monitor for unusual browser processes or hidden windows operating outside standard display coordinates.
• Review browser automation flags and check for unexpected modifications to WebGL or plugin data.
• Enforce session timeouts and multi-factor authentication to limit the value of stolen cookies.
• Keep browser software updated to benefit from security improvements in remote debugging controls.

What to do and how to stay safe: GhostProfile

• Inspect active browser instances for windows positioned off-screen or hidden from the desktop view.
• Verify that browser automation tools are not running unexpectedly on endpoints.
• Check for unauthorized modifications to browser user-data directories or encryption keys.
• Once the vendor provides an update, apply patches that restrict remote debugging access to default profiles.

Step-by-step guide: DDoS Protection for Dedicated Server: Architecture and Mitigation

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does GhostProfile steal passwords directly?

No, it clones browser profiles to access live sessions using existing cookies, rather than extracting passwords for later use.

Can this malware bypass multi-factor authentication?

The disclosure does not confirm that all MFA challenges are bypassed; success depends on session implementation and service-side controls.

Is GhostProfile linked to other malware families?

While it resembles AmnesiaStealer in technique, researchers have not established shared developers, infrastructure, or codebases between them.