Threat reportMalwareTL-2026-3386
GhostProfile macOS Malware Clones Chrome Profiles to Browse With Victims' Live Logins
GhostProfile macOS Malware Clones Chrome Profiles to Browse (TL-2026-3386) is a high-severity malware campaign, first published 2026-10-13 and last reviewed 2026-10-14. It has no confirmed attribution, affects Apple macOS, maps to 15 MITRE ATT&CK techniques (T1005, T1036.005, T1059.004), and is covered by 9 detection rules and 25 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 15MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 25Indicators of compromise
Key facts for TL-2026-3386
- Threat ID
- TL-2026-3386
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 25
- Updates
- 2026-10-14 · revalidated 1× · latest source
Malware and tooling in GhostProfile macOS Malware Clones Chrome Profiles to Browse
Malware and tooling: GhostProfile, ghost browser, Chrome DevTools Protocol, WebDriver BiDi
How GhostProfile macOS Malware Clones Chrome Profiles to Browse works
GhostProfile is a macOS hidden-VNC implant disclosed by Moonlock Lab on 2026-10-12. It creates a disposable clone of the victim's Chrome or Firefox profile and drives the resulting 'ghost' browser through Chrome DevTools Protocol (CDP) and WebDriver BiDi, letting an operator use the victim's authenticated sessions without activity appearing in the victim's own browser window.
GhostProfile is a newly reported macOS implant described by Moonlock Lab as a hidden-VNC tool. Unlike classic VNC implants that mirror the victim's desktop, GhostProfile creates a disposable browser-profile clone and controls the resulting browser through Chrome DevTools Protocol (CDP) and WebDriver BiDi. The cloned 'ghost' browser carries the victim's cookies, so the operator can interact with logged-in services without any of that activity being displayed in the victim's normal browser window. It targets Chrome and Firefox. It is an interactive browser-control implant rather than a tool that only harvests credentials for later replay.
Moonlock Lab disclosed the sample on 2026-10-12 after receiving it from malware researcher @malwrhunterteam, and stated that it 'seems FUD for now' (fully undetectable by AV). Secondary reporting cautions that this is an initial observation, not proof of universal antivirus evasion.
Context on browser mitigations (per GBHackers): since Chrome 136, Chrome no longer honors --remote-debugging-port / --remote-debugging-pipe against the default user-data directory unless a non-standard --user-data-dir is supplied, and the default directory uses separate encryption keys. Cloning the profile into a non-default directory is consistent with working around this restriction, although the public reporting does not confirm the exact mechanism GhostProfile uses.
Intelligence gaps: the public disclosures do not identify the delivery vector or infection chain, persistence mechanism, affected macOS versions, process names or file paths, command-and-control infrastructure, sample hashes, network indicators, victim scope, or attribution. The primary Moonlock Lab report (published via X) was not retrievable; this record is built from two secondary articles and will need enrichment once hashes or a full technical write-up are released. Severity and category are analyst-assigned from the session-hijack impact; no CVE or CVSS applies.
MITRE ATT&CK techniques used in TL-2026-3386
Collection
T1005 Data from Local System; T1113 Screen Capture; T1115 Clipboard Data; T1185 Browser Session Hijacking
Defense Evasion
T1036.005 Masquerading; T1070.004 Indicator Removal; T1553.001 Subvert Trust Controls; T1564 Hide Artifacts; T1564.003 Hidden Window
Execution
T1059.004 Command and Scripting Interpreter
Command and Control
T1105 Ingress Tool Transfer; T1219 Remote Access Tools
Credential Access
T1539 Steal Web Session Cookie; T1555.003 Credentials from Password Stores
Persistence
Affected products and versions in GhostProfile macOS Malware Clones Chrome Profiles to Browse
Remediation for GhostProfile macOS Malware Clones Chrome Profiles to Browse
Patches
- No CVE or vendor patch applies; keep Chrome at version 136 or later, which stops honoring remote-debugging flags against the default profile directory
Immediate actions
- Hunt macOS endpoints for Chrome or Firefox launched with --remote-debugging-port, --remote-debugging-pipe or a non-default --user-data-dir by a non-browser parent process
- Hunt for copies of Chrome/Firefox profile directories (including Cookies databases) created outside the default Application Support paths
- If compromise is suspected, revoke active sessions and refresh tokens for high-value web accounts and rotate credentials from a clean device
Workarounds
- Monitor and alert on automation-protocol (CDP / WebDriver BiDi) listeners on macOS endpoints where browser automation is not expected
Longer-term hardening
- Deploy macOS EDR with process-lineage and command-line telemetry for browser launches
- Enforce device-bound session / token-binding and short session lifetimes on critical SaaS applications
- Restrict execution of unsigned or non-notarized software via Gatekeeper and MDM policy
Timeline of GhostProfile macOS Malware Clones Chrome Profiles to Browse
- Chrome 136 stable ships, no longer honoring --remote-debugging-port / --remote-debugging-pipe against the default user-data directory; the browser-side control GhostProfile-style cloning is consistent with working around.
- Related precedent (separate family, not GhostProfile): BleepingComputer reports Jamf/Moonlock-analyzed AmnesiaStealer, the first documented macOS malware combining a cloned Chromium profile with CDP-based live remote control via a hidden headless browser.
- Initial IOCs published: Mach-O agent and delivery-script SHA-256 hashes, C2 domain txrouteuifbfewfubewfbhgrabbing[.]xyz, ~/Downloads/wohnung install path and com.system.updater LaunchAgent.
- Moonlock Lab states the sample 'seems FUD for now' (not detected by AV engines at time of analysis).
- Moonlock Lab publicly discloses GhostProfile, a macOS hidden-VNC implant that clones browser profiles and controls the clone via CDP and WebDriver BiDi.
- Malware researcher @malwrhunterteam shares a GhostProfile sample with Moonlock Lab.
- Secondary coverage compares GhostProfile with AmnesiaStealer (stream_module also clones browser profiles and attaches to CDP); Moonlock considers the codebases distinct.
- Threat added to the Threadlinqs platform as TL-2026-3386 pending release of a full technical write-up, hashes and infrastructure.
- GBHackers publishes coverage of GhostProfile; Cyber Press also reports on the implant. Neither article discloses hashes, C2 or delivery details.
- BeaconBeagle configuration search for the C2 domain returned zero matches; no known C2-framework correlation at time of research.
Update history for TL-2026-3386
- 2026-10-14 — GhostProfile macOS Malware Clones Browser Profiles to Hijack Live Sessions (hVNC via CDP / WebDriver BiDi): What changed No severity/exploitability/status change (already HIGH / ACTIVE). The record's previously listed gaps (delivery, persistence, hashes, C2, capabilities) are now filled. New indicators (16) 2 SHA-256 hashes (agent and delivery sc
Sources cited for GhostProfile macOS Malware Clones Chrome Profiles to Browse
- New macOS Malware Clones Chrome Profiles and Browses With Victims' Live Logins (GBHackers)
- New Mac Malware Secretly Clones Your Browser and Uses Your Live Logins (Cyber Press)
- Moonlock Lab on X (original disclosure channel)
- WebDriver BiDi - W3C specification
- WebDriver BiDi - MozillaWiki
- Moonlock (MacPaw) macOS security research
- Related precedent: AmnesiaStealer hijacks Chromium browsers (Moonlock)
- Related precedent: New AmnesiaStealer macOS malware hijacks browser sessions via remote control (BleepingComputer)
- Chrome DevTools Protocol documentation
Detection coverage for TL-2026-3386
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3386 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.