A new Mac implant sidesteps the oldest move in remote-control malware. Rather than shadow a victim’s display, it duplicates a browser profile and runs a second, unseen browser wearing the user’s own signed-in identity.
Moonlock Lab, the antivirus research arm of MacPaw, named the family GhostProfile. The sample arrived via MalwareHunterTeam and the findings went public on October 12.
A hidden desktop is yesterday’s approach
Old hidden-VNC implants raise a secret macOS desktop for an operator to poke at. GhostProfile never bothers. It makes a throwaway copy of a browser’s profile folder, then pilots it through the Chrome DevTools Protocol and WebDriver BiDi – interfaces built for test automation.
Inherited cookies are the whole point. An intruder riding a cloned profile reaches accounts that will not ask for a password again, while the real browser stays untouched.
What the operator gets
The window sits far past the edge of any monitor, and the automation flag sites inspect is rewritten to read clean. WebGL fingerprints and plugin lists are disguised to match an ordinary machine. An operator pulls JPEG stills and pushes back clicks and keystrokes, with the invisible browser pre-approved for camera, microphone, location and clipboard. The tool doubles as a loader – hand it an archive and it mounts, clears quarantine and runs whatever app sits inside.
How it lands and stays put
Delivery pipes downloaded content into zsh through a single shell line. From there a script collects the agent, wipes its quarantine attribute, plants the binary in Downloads and installs a LaunchAgent masquerading as a system updater, kept alive by RunAtLoad and KeepAlive. Chromium browsers and Firefox are the targets, their cookie stores read through SQLite.
Slapdash leftovers – a readable hVNC banner and a default pre-shared key – mark a rough tool, not a finished product.
