GhostProfile macOS Malware Clones Browser Profiles to Hijack Live Sessions

A new strain of macOS malware, dubbed GhostProfile, has emerged with a sophisticated technique that allows attackers to hijack live browser sessions without stealing passwords. Instead of traditional remote access methods that mirror a victim's screen, GhostProfile creates a hidden, cloned browser profile. This allows threat actors to operate within a separate browser instance, leveraging the victim's active logins and cookies to access accounts and browse websites undetected.

Researchers at Moonlock Lab, in collaboration with MalwareHunterTeam, identified GhostProfile and noted its initial evasion of some security products. The malware employs advanced browser automation protocols, specifically Chrome DevTools Protocol (CDP) and WebDriver BiDi, to interact with the cloned browser. This enables operators to control the hidden browser session as if it were their own, making malicious activity harder to spot as it doesn't involve visible changes to the user's primary desktop.

To further conceal its operations, GhostProfile positions the cloned browser window far off-screen, making it invisible to the user. It also manipulates browser characteristics, such as automation flags and spoofed WebGL and plugin information, to appear less suspicious to websites. The malware can capture screenshots in JPEG format and simulate user input, effectively allowing remote control of the cloned browser environment.

The infection chain typically begins with a shell command that downloads and executes a delivery script. This script then fetches the main agent, removes quarantine attributes, places the payload in the user's Downloads folder, and establishes persistence. GhostProfile achieves persistence by creating a fake system-updater LaunchAgent, a common tactic that abuses trusted-sounding names to hide its presence and ensure automatic startup.

GhostProfile primarily targets Chromium-based browsers and Firefox. It accesses cookie stores using SQLite and can read the system clipboard via macOS's NSPasteboard interface. The malware also includes a hidden VNC (hVNC) banner and temporary working directories that are cleaned up upon exit. A notable feature is its upload-and-run capability, allowing an operator to send a ZIP archive or disk image, which the agent can then extract, launch, and execute, potentially serving as a loader for additional malware.

The implications of GhostProfile are significant, as it bypasses the need for password theft by directly exploiting active sessions. This method is reminiscent of techniques seen in other information-stealing malware, but GhostProfile's direct control over a hidden, cloned browser session offers a unique and potent threat. While the initial delivery script may be detectable, the core functionality of GhostProfile presents a substantial risk to macOS users.

Security teams are advised to monitor for unusual browser profile cloning, hidden browser launches, and suspicious LaunchAgent entries. Prompt investigation of suspected infections, isolation of affected systems, and preservation of evidence are crucial. Recovering from an infection should involve revoking active sessions and changing credentials from a trusted device, rather than solely relying on password resets.