New macOS Malware Clones Chrome Profiles and Browses With Victims’ Live Logins

GhostProfile is a reported macOS implant that creates disposable clones of browser profiles and remotely operates hidden Chrome/Firefox instances using CDP and WebDriver BiDi so attackers can browse with victims' authenticated sessions. The disclosure frames this as an interactive, covert browser-control capability rather than a passive credential stealer, but provides limited technical proof, no hashes or network indicators, and unresolved questions about persistence, delivery, and whether browser encryption or device-bound protections are actually defeated.