Moonlock Lab discloses GhostProfile macOS malware that hides Chrome sessions to evade screen mirroring detection

Moonlock Lab researchers disclosed a macOS implant named GhostProfile on October 12, revealing how it clones browser profiles to operate concealed copies of Chrome or Firefox. The malware allows attackers to navigate websites using victims’ active authentication sessions without displaying the activity on the victim’s visible desktop.

Unlike traditional hidden Virtual Network Computing tools that mirror the entire screen, GhostProfile builds a temporary browser workspace. It copies the victim’s browser profile, including cookies, and controls the resulting hidden browser through the Chrome DevTools Protocol and WebDriver BiDi. This design enables operators to interact with logged-in services while the victim’s normal browser window remains unchanged.

View the original post on X

Technical Operation and Detection Evasion

The implant moves its browser window to screen coordinates far outside the visible display area. It also modifies the browser’s automation flag and spoofs WebGL and plugin information to make automated browsing less obvious to websites. Operators receive JPEG screenshots of the hidden session and can send simulated mouse clicks and keyboard input to navigate pages.

According to Moonlock’s disclosure, the malware carries the victim’s cookies, enabling an operator to interact with services without triggering a password prompt. The researchers described this as an interactive browser-control implant rather than a simple credential collector. The underlying protocols are legitimate automation interfaces that Mozilla documents for controlling browsing contexts and executing scripts.

Disclosure and Browser Changes

Moonlock Lab published their findings on October 12 after receiving a sample from malware researcher @malwrhunterteam. In their initial research thread, the team noted the sample appeared undetected at that time, though they clarified the delivery script was already detectable by some security solutions. The disclosure does not establish universal antivirus evasion or confirm that every website accepts the cloned session.

Google introduced a change starting with Chrome 136 that stops honoring remote debugging flags against the default data directory unless a nonstandard user-data directory is supplied. This change uses a different encryption key for separate directories, protecting existing Chrome data from this specific attack route. The technical significance of GhostProfile’s profile-cloning claim depends on these browser-side protections.

What should you do?

Security professionals should monitor for unusual browser processes running with non-standard user-data directories. Organizations using endpoint detection should look for automation flags being modified or browser windows positioned outside visible screen coordinates. Users should enable multi-factor authentication that requires device-bound verification, as cloned sessions may bypass cookie-based logins.

What to do and how to stay safe: GhostProfile

• Check for browser instances running with custom user-data directories that do not match the user’s primary profile.
• Monitor network traffic for WebSocket connections associated with WebDriver BiDi or Chrome DevTools Protocol from unexpected sources.
• Verify that browser automation flags are not being spoofed by reviewing process memory or using endpoint detection tools.
• Require step-up authentication for sensitive actions, ensuring that cloned sessions cannot perform critical operations without additional verification.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does GhostProfile steal passwords from the victim’s browser?

No, the malware clones browser profiles to use existing authenticated sessions, allowing attackers to browse with live logins without necessarily extracting stored passwords.

Can this malware bypass multi-factor authentication?

The disclosure does not establish that device-bound protections or additional authentication challenges are bypassed; outcomes depend on the service-side controls and session implementation.

Is GhostProfile related to other malware like AmnesiaStealer?

Similar behavior does not establish that GhostProfile and AmnesiaStealer share developers, infrastructure, or an underlying codebase, according to the researchers.