# GhostProfile macOS Malware Clones Chrome Profiles to Browse With Victims' Live Logins

> GhostProfile is a macOS hidden-VNC implant disclosed by Moonlock Lab on 2026-10-12. It creates a disposable clone of the victim's Chrome or Firefox profile and drives the resulting 'ghost' browser through Chrome DevTools Protocol (CDP) and WebDriver BiDi, letting an operator use the victim's authenticated sessions without activity appearing in the victim's own browser window.

- **Published:** 2026-10-13T08:06:42Z
- **Last reviewed:** 2026-10-14T06:08:25.578Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3386
- **ID:** TL-2026-3386
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

GhostProfile is a newly reported macOS implant described by Moonlock Lab as a hidden-VNC tool. Unlike classic VNC implants that mirror the victim's desktop, GhostProfile creates a disposable browser-profile clone and controls the resulting browser through Chrome DevTools Protocol (CDP) and WebDriver BiDi. The cloned 'ghost' browser carries the victim's cookies, so the operator can interact with logged-in services without any of that activity being displayed in the victim's normal browser window. It targets Chrome and Firefox. It is an interactive browser-control implant rather than a tool that only harvests credentials for later replay.

Moonlock Lab disclosed the sample on 2026-10-12 after receiving it from malware researcher @malwrhunterteam, and stated that it 'seems FUD for now' (fully undetectable by AV). Secondary reporting cautions that this is an initial observation, not proof of universal antivirus evasion.

Context on browser mitigations (per GBHackers): since Chrome 136, Chrome no longer honors --remote-debugging-port / --remote-debugging-pipe against the default user-data directory unless a non-standard --user-data-dir is supplied, and the default directory uses separate encryption keys. Cloning the profile into a non-default directory is consistent with working around this restriction, although the public reporting does not confirm the exact mechanism GhostProfile uses.

Intelligence gaps: the public disclosures do not identify the delivery vector or infection chain, persistence mechanism, affected macOS versions, process names or file paths, command-and-control infrastructure, sample hashes, network indicators, victim scope, or attribution. The primary Moonlock Lab report (published via X) was not retrievable; this record is built from two secondary articles and will need enrichment once hashes or a full technical write-up are released. Severity and category are analyst-assigned from the session-hijack impact; no CVE or CVSS applies.

## MITRE ATT&CK

- T1539 Steal Web Session Cookie
- T1185 Browser Session Hijacking
- T1005 Data from Local System
- T1564 Hide Artifacts
- T1564.003 Hidden Window
- T1219 Remote Access Tools
- T1059.004 Command and Scripting Interpreter
- T1543.001 Create or Modify System Process
- T1553.001 Subvert Trust Controls
- T1036.005 Masquerading
- T1070.004 Indicator Removal
- T1555.003 Credentials from Password Stores
- T1115 Clipboard Data
- T1113 Screen Capture
- T1105 Ingress Tool Transfer

## Sources

- [New macOS Malware Clones Chrome Profiles and Browses With Victims' Live Logins (GBHackers)](https://gbhackers.com/macos-malware-hijacks-chrome/)
- [New Mac Malware Secretly Clones Your Browser and Uses Your Live Logins (Cyber Press)](https://cyberpress.org/mac-malware-hijacks-sessions/)
- [Moonlock Lab on X (original disclosure channel)](https://twitter.com/moonlock_lab)
- [WebDriver BiDi - W3C specification](https://w3c.github.io/webdriver-bidi/)
- [WebDriver BiDi - MozillaWiki](https://wiki.mozilla.org/WebDriver/RemoteProtocol/WebDriver_BiDi)
- [Moonlock (MacPaw) macOS security research](https://moonlock.com/)
- [Related precedent: AmnesiaStealer hijacks Chromium browsers (Moonlock)](https://moonlock.com/amnesiastealer-hijacks-chromium-browsers)
- [Related precedent: New AmnesiaStealer macOS malware hijacks browser sessions via remote control (BleepingComputer)](https://www.bleepingcomputer.com/news/security/new-amnesiastealer-macos-malware-hijacks-browser-sessions-via-remote-control/)
- [Chrome DevTools Protocol documentation](https://chromedevtools.github.io/devtools-protocol/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3386