> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox - URL: https://f4n6.co.uk/security-feed/macos-gaslight-rust-backdoor-turns-prompt-injection-on-the-analyst-not-the-sandbox/ - Published: 2026-06-24T09:15:45.000Z - Updated: 2026-06-24T09:15:45.000Z - Author: Jeff Davies - Tags: #security-feed, DPRK, Lazarus ## 1\. Executive summary SentinelLABS has disclosed a Rust-written macOS implant and infostealer, tracked as **macOS.Gaslight**, that combines conventional macOS tradecraft with a novel analyst-targeting capability: a 3.5 KB cascade of 38 fabricated "system" messages designed to make an LLM-assisted triage agent abort, truncate, or refuse analysis. The implant communicates with its operator over the Telegram Bot API using AES-GCM-encrypted payloads over certificate-pinned TLS, supports an interactive shell, harvests `login.keychain-db` and host profiling data, and persists via a LaunchAgent masquerading as `com.apple.system.services.activity`. SentinelLABS assesses with high confidence that the implant sits within a cluster of DPRK-aligned macOS activity; per our reference data, no MITRE ATT&CK profile exists for "DPRK", and this attribution is therefore **unconfirmed**. The primary risk to EMEA financial services is credential and session theft from macOS endpoints (analyst workstations, trader desks, mobile-macOS users) and the potential for the implant to evade AI-assisted SOC tooling that ingests sample output. ## 2\. Regulatory framing | Article | Trigger (fact in this item) | Practical impact | | ------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17: ICT-related incident management process | The implant is an active macOS threat requiring a documented incident-handling workflow (detection, triage, eradication, recovery). | Financial entities must run the response through their ICT-related incident management process, with defined roles, evidence handling, and post-incident review. | | DORA Art. 18: classification of ICT-related incidents and cyber threats | The implant is a credential-harvesting infostealer with persistent foothold capability — a cyber threat requiring formal severity classification. | Classify against the entity's ICT incident taxonomy; severity drives downstream reporting and testing obligations. | | DORA Art. 19: reporting of major ICT-related incidents to competent authorities | A confirmed infection on a production endpoint that meets the entity's "major" threshold (e.g. compromise of privileged credentials, exfiltration of keychain material) triggers initial, intermediate, and final reporting. | Report within the prescribed windows to the competent authority; preserve evidence before reimaging. | | DORA Art. 24: digital operational resilience testing — general requirements | The implant's anti-analysis and prompt-injection behaviour against LLM-assisted tooling means SOC/IR tooling itself is in scope for resilience testing. | Include AI-assisted triage pipelines in scope of testing programmes; validate that hostile sample output cannot influence automated analysis. | | DORA Art. 28: ICT third-party risk — general principles | The implant stages a third-party CPython interpreter (astral-sh/python-build-standalone) and uses Telegram as a third-party C2 channel. | Assess and document third-party risk for runtime-staged interpreters and consumer messaging APIs used as C2. | | DORA Art. 29: preliminary assessment of ICT concentration risk | Reliance on Telegram Bot API as C2 and on a single Python distribution source creates concentration considerations. | Evaluate whether the entity's detection and response tooling depends on a single vendor or channel that could be blinded by this tradecraft. | | DORA Art. 30: key contractual provisions with ICT third-party providers | Endpoint protection, EDR, and SOC tooling contracts must permit the logging, retention, and lawful sharing needed to investigate this tradecraft. | Confirm contractual rights to capture and share Telegram API traffic, LaunchAgent artefacts, and keychain access logs. | | NIS2 Art. 21(2)(d): supply chain security measures | The implant demonstrates runtime staging of a third-party interpreter and abuse of a third-party messaging platform — both supply-chain vectors. | Apply supply-chain controls covering runtime interpreter staging and vetting of consumer messaging APIs as C2. | | NIS2 Art. 23: incident reporting obligations | A confirmed infection on an in-scope entity triggers early warning, incident notification, and final reporting under NIS2 timelines. | Notify the relevant CSIRT within NIS2-mandated windows; preserve evidence. | | UK NIS 2018: UK Network and Information Systems Regulations — OES/RDSP duties | A confirmed infection on an OES/RDSP system (e.g. a financial-services operator of essential services) engages UK NIS incident-response duties. | Follow the operator's incident-response process under UK NIS and notify as required. | ## 3\. Technical analysis & attack chain 1. **Initial delivery (unconfirmed mechanism).** The Mach-O sample was first observed on VirusTotal on 22 May 2026; the delivery vector is not described in the source material. 2. **Execution.** The binary is ad hoc signed with identifier `endpoint-macos-aarch64-5555494492fc075f441637fb9d894913dde3a2ea` and runs as a Mach-O on macOS (aarch64 focus). It resolves its own executable path at runtime via `__NSGetExecutablePath` and resolves API calls via `dlsym` to avoid static symbol exposure. 3. **Persistence.** A LaunchAgent is installed with `Label com.apple.system.services.activity`, masquerading inside Apple's `com.apple.*` namespace. The absolute path to the implant is written into the plist's `ProgramArguments` array. Persistence is gated by the `persist_enable` serde config field. 4. **Sleep prevention.** The implant calls `IOPMAssertionCreateWithName` to hold a power-management assertion, preventing system sleep and sustaining long-running C2 polling. 5. **C2 channel — Telegram Bot API.** The implant polls `getUpdates` over the Telegram Bot API. The polling branch executes only when no webhook is registered. The dispatch handler keys on three Telegram error codes: `BotBlocked`, `InvalidToken`, and `Conflict`. A `Conflict` response (two instances polling the same token) is treated as an implicit single-instance lock; a second copy terminates. 6. **Transport hardening.** C2 payloads are encrypted with AES-GCM using the pure-Rust `aes-gcm 0.10.3` crate, with a fresh nonce per message generated via `CCRandomGenerateBytes`. The AES key is supplied at runtime via the `aes_key` serde config field. TLS is pinned via a custom trust anchor and `SecTrustSetAnchorCertificatesOnly`, rejecting proxy-CA interception. The implant reads the active system proxy via `SCDynamicStoreCopyProxies` and routes its `reqwest`/`hyper` stack through it. 7. **Credential redaction.** When the URL path segment is the 4-byte literal `file` (`0x656c6966` little-endian), the Telegram URL constructor substitutes the bot token with the hardcoded placeholder `file/token:redacted`, preventing the live token from appearing in logs, errors, or crash artefacts. 8. **Operator commands.** Six confirmed verbs: `help`, `id`, `shell` (via `execvp`, with `posix_spawnp` as an alternative spawn path), `kill` (terminate by PID), `upload` (exfiltrate file via Telegram `attach://` multipart upload), `stop` (halt implant). A possible seventh verb `focus` is referenced but not recovered. 9. **Data collection.** A 6.6 KB base64-encoded Python script is bundled; once decoded it harvests `ps aux`, `system_profiler`, and `login.keychain-db`. Output is archived to `temp/collected_data.zip` and uploaded to the operator via Telegram. 10. **Python staging.** A separate 2 KB base64-encoded bash installer fetches a self-contained `cpython-3.10.18` interpreter from `astral-sh/python-build-standalone`, targeting both arm64 and x86\_64 macOS. The installer carries the literal constants `PY_VERSION=3.10.18` and `BUILD_DATE=20250708`. The Python stealer and installer are gated by the `init_python_enable` serde config field. 11. **Analyst-targeting prompt injection.** The implant carries a 3.5 KB Markdown-fenced blob of 38 fabricated "system" messages delimited with `{{DATA}}` tokens, mimicking an LLM triage harness's own prompt scaffold. The content includes fake token-expiry notices, OOM kills, disk-exhaustion warnings, and bogus injection/static-analysis flags, intended to push an LLM agent into aborting, truncating, or refusing analysis. **Operator configuration schema (15 fields, plaintext in binary):** `aes_key`, `tg_room_id`, `persist_enable`, `init_python_enable`, `payload_path_linux`/`payload_path_macos`, `persist_name_linux`/`persist_name_macos`, `persist_type_linux`/`persist_type_macos`, `github_token`, `github_repo`, `github_polling_interval`. Linux and GitHub fields are not exercised in this sample. **Caveats.** The delivery vector is not described. SentinelLABS assesses the implant as DPRK-aligned with high confidence based on Apple's XProtect rules (`MACOS_BONZAI_COBUCH`, `AIRPIPE`); per our reference data, "DPRK" has no MITRE ATT&CK profile and this attribution is **unconfirmed**. The `focus` verb and the exact runtime branch logic for persistence and Python staging were not recovered from the sample. ## 4\. Mitigation & containment ### P1 — within 24 hours (containment and hunt) - Block the Mach-O sample hash and the two Python/Bash payload hashes at the EDR/AV gateway and on macOS endpoints. - Hunt across the macOS fleet for the LaunchAgent Label `com.apple.system.services.activity` in `~/Library/LaunchAgents/` and `/Library/LaunchAgents/`, and for any plist whose `ProgramArguments` resolves to a binary matching the ad hoc signing identifier `endpoint-macos-aarch64-5555494492fc075f441637fb9d894913dde3a2ea`. - Hunt for outbound traffic to `api.telegram.org` (Bot API endpoints) from processes that are not sanctioned Telegram clients; treat any such traffic from a non-browser, non-Telegram process as suspect. - Isolate any macOS endpoint showing the IOC set; preserve a forensic image before reimaging. - Force-rotate any credentials, keychain items, or session tokens present on a confirmed-infected host; assume `login.keychain-db` is compromised. ### P2 — within 72 hours (remediation) - Remove the LaunchAgent plist and the implant binary; verify no residual artefacts in `temp/collected_data.zip` paths or in user `~/Library` directories. - Pin or block outbound `api.telegram.org` Bot API traffic at the egress proxy for endpoints that have no business need; allow-list only sanctioned Telegram integrations. - Update Apple XProtect definitions to the latest; confirm the `MACOS_BONZAI_COBUCH` and `AIRPIPE` rules are active. - For SOC/IR pipelines that use LLM-assisted triage: ensure hostile sample output (the `{{DATA}}`\-delimited Markdown blob) is stripped or sandboxed before reaching the model; treat sample contents as adversarial input, never as instructions. ### P3 — within 7 days (hardening) - Enable macOS notarisation / Gatekeeper enforcement and block ad hoc–signed binaries from launching where policy permits. - Restrict `IOPMAssertionCreateWithName` abuse via EDR rules that flag long-lived power assertions from non-Apple binaries. - Add EDR rules to alert on `dlsym`\-resolved API calls combined with `__NSGetExecutablePath` use from non-Apple binaries. - Review and tighten supply-chain controls covering runtime interpreter staging (e.g. block `astral-sh/python-build-standalone` fetches from non-build hosts) and consumer messaging APIs as C2 channels. ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | ------------------ | ------------------------------------------------------------------ | ---------- | ------------------------------------------- | | sha256 | 6328567511d88fdc2ae0939c5ef17b7a63d2a833881900de018a4f12f4982525 | high | SentinelLABS (macOS.Gaslight Mach-O sample) | | sha256 | 77b4fd46994992f0e57302cfe76ed23c0d90101381d2b89fc2ddf5c4536e77ca | high | SentinelLABS (sibling BONZAI sample) | | sha256 | baabf249c77bc54c54ab0e66e15af798bd28aa5b4683554456a8b73ab8741239 | high | SentinelLABS (Python payload script) | | sha256 | b3c56d689414343589f38394d19ba2fe9a518133281200faa0556ba4e4136394 | high | SentinelLABS (Bash installer script) | | signing-identifier | endpoint-macos-aarch64-5555494492fc075f441637fb9d894913dde3a2ea | high | SentinelLABS (ad hoc signing identifier) | | launchagent-label | com.apple.system.services.activity | high | SentinelLABS (LaunchAgent Label) | | xprotect-rule | MACOS\_BONZAI\_COBUCH | high | SentinelLABS (Apple XProtect rule) | | xprotect-rule | AIRPIPE | high | SentinelLABS (Apple XProtect rule) | | domain | api.telegram.org | medium | SentinelLABS (Telegram Bot API C2) | | domain | astral-sh.github.io / github.com/astral-sh/python-build-standalone | high | SentinelLABS (Python interpreter staging) | ```iocs sha256 6328567511d88fdc2ae0939c5ef17b7a63d2a833881900de018a4f12f4982525 sha256 77b4fd46994992f0e57302cfe76ed23c0d90101381d2b89fc2ddf5c4536e77ca sha256 baabf249c77bc54c54ab0e66e15af798bd28aa5b4683554456a8b73ab8741239 sha256 b3c56d689414343589f38394d19ba2fe9a518133281200faa0556ba4e4136394 signing-identifier endpoint-macos-aarch64-5555494492fc075f441637fb9d894913dde3a2ea launchagent-label com.apple.system.services.activity xprotect-rule MACOS_BONZAI_COBUCH xprotect-rule AIRPIPE domain api.telegram.org domain astral-sh.github.io ``` ## 6\. Detection ```yara rule macOS_Gaslight_Rust_Backdoor { meta: author = "Adverse Trace" date = "2026-06-24" reference = "https://www.sentinelone.com/labs/macos-gaslight-rust-backdoor-turns-prompt-injection-on-the-analyst-not-the-sandbox/" description = "macOS.Gaslight Rust backdoor — ad hoc signing identifier, LaunchAgent label, XProtect rule names, and analyst-targeting prompt-injection scaffold" strings: $signing_id = "endpoint-macos-aarch64-5555494492fc075f441637fb9d894913dde3a2ea" ascii wide $launchd_label = "com.apple.system.services.activity" ascii wide $xrule1 = "MACOS_BONZAI_COBUCH" ascii wide $xrule2 = "AIRPIPE" ascii wide $pyver = "PY_VERSION=3.10.18" ascii $builddate = "BUILD_DATE=20250708" ascii $aesgcm = "aes-gcm 0.10.3" ascii $redact = "file/token:redacted" ascii $data_tok = "{{DATA}}" ascii wide $persist = "persist_enable" ascii $initpy = "init_python_enable" ascii $tgroom = "tg_room_id" ascii $aeskey = "aes_key" ascii $ghrepo = "github_repo" ascii $ghtoken = "github_token" ascii $ghpoll = "github_polling_interval" ascii $payload_macos = "payload_path_macos" ascii $persist_name_macos = "persist_name_macos" ascii $persist_type_macos = "persist_type_macos" ascii $err_blocked = "BotBlocked" ascii wide $err_invalid = "InvalidToken" ascii wide $err_conflict = "Conflict" ascii wide $attach = "attach://" ascii wide condition: // signing identifier OR launchagent label OR (xprotect rule pair AND any two config fields) $signing_id or $launchd_label or (1 of ($xrule*) and 2 of ($persist, $initpy, $tgroom, $aeskey, $ghrepo, $ghtoken, $ghpoll, $payload_macos, $persist_name_macos, $persist_type_macos)) } ``` ```yaml title: macOS.Gaslight LaunchAgent Persistence id: 8c1f3a2e-macos-gaslight-launchagent status: experimental description: > Detects creation of a macOS LaunchAgent with the macOS.Gaslight Label com.apple.system.services.activity, or any LaunchAgent whose ProgramArguments resolves to a binary matching the Gaslight ad hoc signing identifier. author: Adverse Trace date: 2026-06-24 reference: https://www.sentinelone.com/labs/macos-gaslight-rust-backdoor-turns-prompt-injection-on-the-analyst-not-the-sandbox/ logsource: product: macos category: process_creation detection: selection_launchctl: Image|endswith: launchctl CommandLine|contains: load CommandLine|contains: com.apple.system.services.activity selection_label: CommandLine|contains: com.apple.system.services.activity condition: selection_launchctl or selection_label level: high tags: - attack.persistence - attack.t1543.001 --- title: macOS.Gaslight Telegram Bot API C2 id: 8c1f3a2e-macos-gaslight-telegram-c2 status: experimental description: > Detects non-browser, non-sanctioned-Telegram-client processes on macOS contacting the Telegram Bot API (api.telegram.org) — the channel used by macOS.Gaslight for C2 and exfiltration. author: Adverse Trace date: 2026-06-24 reference: https://www.sentinelone.com/labs/macos-gaslight-rust-backdoor-turns-prompt-injection-on-the-analyst-not-the-sandbox/ logsource: product: macos category: dns_query detection: selection_domain: QueryName|endswith: api.telegram.org filter_known_clients: Image|endswith: - "/Telegram.app/Contents/MacOS/Telegram" - "/Telegram Desktop.app/Contents/MacOS/Telegram" condition: selection_domain and not filter_known_clients level: high tags: - attack.command_and_control - attack.t1071.001 ``` ## Threat actor context **Lazarus Group** · [G0032](https://attack.mitre.org/groups/G0032?ref=f4n6.co.uk) · aka Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY [Lazarus Group](https://attack.mitre.org/groups/G0032?ref=f4n6.co.uk) is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [Lazarus Group](https://attack.mitre.org/groups/G0032?ref=f4n6.co.uk) has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. … *No MITRE ATT&CK profile for: DPRK.* ## 7\. Sources - SentinelOne Labs / SentinelLABS — *macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox* — https://www.sentinelone.com/labs/macos-gaslight-rust-backdoor-turns-prompt-injection-on-the-analyst-not-the-sandbox/ — 2026-06-23 ## 8\. Adverse Trace position macOS.Gaslight is a credible, well-engineered macOS implant whose tradecraft — Telegram Bot API C2, AES-GCM with certificate pinning, keychain theft, LaunchAgent persistence — is established, but whose analyst-targeting prompt-injection cascade is novel and operationally significant for any SOC that has folded LLM-assisted triage into its reverse-engineering loop. Severity for affected EMEA financial services firms is **high** where macOS endpoints host privileged credentials, trading or treasury workstations, or analyst workstations whose output feeds AI-assisted detection; elsewhere it is **medium**. Attribution to DPRK-aligned activity is reported by SentinelLABS with high confidence but, per our reference data, "DPRK" has no MITRE ATT&CK profile and is therefore treated as **unconfirmed**. We will next (i) monitor for additional samples and any recovery of the runtime-supplied `aes_key` or Telegram bot token, (ii) track whether the `focus` verb and the persistence/Python-staging branches are confirmed in follow-on reporting, and (iii) update this advisory if Apple XProtect rule coverage expands beyond hash-based detection. --- [Read the original source →](https://www.sentinelone.com/labs/macos-gaslight-rust-backdoor-turns-prompt-injection-on-the-analyst-not-the-sandbox/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*