Key points
- GhostProfile creates disposable browser clones controlled via CDP and WebDriver BiDi protocols.
- Attackers can interact with authenticated services without displaying activity in the user's main window.
- Google Chrome 136 introduced a mitigation requiring a non-standard user data directory for remote debugging.
A newly identified macOS implant known as GhostProfile enables attackers to remotely control concealed copies of Chrome or Firefox browsers. According to a report by GBHackers, the malware clones existing browser profiles to access victims' authenticated sessions. This allows operators to browse websites using the victim's live logins without the user seeing the activity on their screen.
In plain English
GhostProfile functions as a hidden remote control tool that does not mirror the victim's entire desktop. Instead, it creates a separate, disposable copy of a browser profile. This clone retains the victim's cookies and authentication state, allowing attackers to navigate logged-in services invisibly. The researchers described it as an interactive browser-control implant rather than a simple credential harvester.
View the original post on X
The background
Moonlock Lab disclosed the malware on 12 October after receiving a sample from researcher @malwrhunterteam. The implant repurposes legitimate automation interfaces, specifically Chrome DevTools Protocol and WebDriver BiDi. These protocols allow scripts to control browsing contexts and monitor network activity. GhostProfile uses this bidirectional communication model to issue commands and receive events covertly.
What changes now
The disclosure highlights that session validity depends on browser and service-side controls. Not every website may accept the cloned session, and device-bound protections might still apply. However, accounts with valid existing sessions could be exposed without further password prompts. Google Chrome 136 now blocks remote debugging against default data directories unless a specific non-standard directory is supplied.
What to do and how to stay safe: GhostProfile
- Monitor for unauthorized browser processes or unexpected network connections originating from Chrome or Firefox.
- Review active sessions in critical accounts and revoke any that appear unfamiliar or suspicious.
- Ensure all browsers are updated to the latest versions to benefit from recent security hardening.
- Educate users on the risks of allowing remote debugging tools or automation scripts on managed devices.
Step-by-step guide: Phishing vs Spam: How to Tell the Difference and Stop Threats
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does GhostProfile steal passwords directly?
No, it clones browser profiles to use existing authenticated sessions, avoiding the need for new password prompts.
Which browsers are affected by this technique?
The report specifically mentions Chrome and Firefox as targets for the profile cloning and remote control methods.
Is there a fix for this vulnerability?
Google Chrome 136 includes a mitigation that restricts remote debugging, but no broader patch for the malware itself is confirmed.
