macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox

1. Executive summary

SentinelLABS has disclosed a Rust-written macOS implant and infostealer, tracked as macOS.Gaslight, that combines conventional macOS tradecraft with a novel analyst-targeting capability: a 3.5 KB cascade of 38 fabricated "system" messages designed to make an LLM-assisted triage agent abort, truncate, or refuse analysis. The implant communicates with its operator over the Telegram Bot API using AES-GCM-encrypted payloads over certificate-pinned TLS, supports an interactive shell, harvests login.keychain-db and host profiling data, and persists via a LaunchAgent masquerading as com.apple.system.services.activity. SentinelLABS assesses with high confidence that the implant sits within a cluster of DPRK-aligned macOS activity; per our reference data, no MITRE ATT&CK profile exists for "DPRK", and this attribution is therefore unconfirmed. The primary risk to EMEA financial services is credential and session theft from macOS endpoints (analyst workstations, trader desks, mobile-macOS users) and the potential for the implant to evade AI-assisted SOC tooling that ingests sample output.

2. Regulatory framing

3. Technical analysis & attack chain

1. Initial delivery (unconfirmed mechanism). The Mach-O sample was first observed on VirusTotal on 22 May 2026; the delivery vector is not described in the source material.
2. Execution. The binary is ad hoc signed with identifier endpoint-macos-aarch64-5555494492fc075f441637fb9d894913dde3a2ea and runs as a Mach-O on macOS (aarch64 focus). It resolves its own executable path at runtime via __NSGetExecutablePath and resolves API calls via dlsym to avoid static symbol exposure.
3. Persistence. A LaunchAgent is installed with Label com.apple.system.services.activity, masquerading inside Apple's com.apple.* namespace. The absolute path to the implant is written into the plist's ProgramArguments array. Persistence is gated by the persist_enable serde config field.
4. Sleep prevention. The implant calls IOPMAssertionCreateWithName to hold a power-management assertion, preventing system sleep and sustaining long-running C2 polling.
5. C2 channel — Telegram Bot API. The implant polls getUpdates over the Telegram Bot API. The polling branch executes only when no webhook is registered. The dispatch handler keys on three Telegram error codes: BotBlocked, InvalidToken, and Conflict. A Conflict response (two instances polling the same token) is treated as an implicit single-instance lock; a second copy terminates.
6. Transport hardening. C2 payloads are encrypted with AES-GCM using the pure-Rust aes-gcm 0.10.3 crate, with a fresh nonce per message generated via CCRandomGenerateBytes. The AES key is supplied at runtime via the aes_key serde config field. TLS is pinned via a custom trust anchor and SecTrustSetAnchorCertificatesOnly, rejecting proxy-CA interception. The implant reads the active system proxy via SCDynamicStoreCopyProxies and routes its reqwest/hyper stack through it.
7. Credential redaction. When the URL path segment is the 4-byte literal file (0x656c6966 little-endian), the Telegram URL constructor substitutes the bot token with the hardcoded placeholder file/token:redacted, preventing the live token from appearing in logs, errors, or crash artefacts.
8. Operator commands. Six confirmed verbs: help, id, shell (via execvp, with posix_spawnp as an alternative spawn path), kill (terminate by PID), upload (exfiltrate file via Telegram attach:// multipart upload), stop (halt implant). A possible seventh verb focus is referenced but not recovered.
9. Data collection. A 6.6 KB base64-encoded Python script is bundled; once decoded it harvests ps aux, system_profiler, and login.keychain-db. Output is archived to temp/collected_data.zip and uploaded to the operator via Telegram.
10. Python staging. A separate 2 KB base64-encoded bash installer fetches a self-contained cpython-3.10.18 interpreter from astral-sh/python-build-standalone, targeting both arm64 and x86_64 macOS. The installer carries the literal constants PY_VERSION=3.10.18 and BUILD_DATE=20250708. The Python stealer and installer are gated by the init_python_enable serde config field.
11. Analyst-targeting prompt injection. The implant carries a 3.5 KB Markdown-fenced blob of 38 fabricated "system" messages delimited with {{DATA}} tokens, mimicking an LLM triage harness's own prompt scaffold. The content includes fake token-expiry notices, OOM kills, disk-exhaustion warnings, and bogus injection/static-analysis flags, intended to push an LLM agent into aborting, truncating, or refusing analysis.

Operator configuration schema (15 fields, plaintext in binary): aes_key, tg_room_id, persist_enable, init_python_enable, payload_path_linux/payload_path_macos, persist_name_linux/persist_name_macos, persist_type_linux/persist_type_macos, github_token, github_repo, github_polling_interval. Linux and GitHub fields are not exercised in this sample.

Caveats. The delivery vector is not described. SentinelLABS assesses the implant as DPRK-aligned with high confidence based on Apple's XProtect rules (MACOS_BONZAI_COBUCH, AIRPIPE); per our reference data, "DPRK" has no MITRE ATT&CK profile and this attribution is unconfirmed. The focus verb and the exact runtime branch logic for persistence and Python staging were not recovered from the sample.

4. Mitigation & containment

P1 — within 24 hours (containment and hunt)

• Block the Mach-O sample hash and the two Python/Bash payload hashes at the EDR/AV gateway and on macOS endpoints.
• Hunt across the macOS fleet for the LaunchAgent Label com.apple.system.services.activity in ~/Library/LaunchAgents/ and /Library/LaunchAgents/, and for any plist whose ProgramArguments resolves to a binary matching the ad hoc signing identifier endpoint-macos-aarch64-5555494492fc075f441637fb9d894913dde3a2ea.
• Hunt for outbound traffic to api.telegram.org (Bot API endpoints) from processes that are not sanctioned Telegram clients; treat any such traffic from a non-browser, non-Telegram process as suspect.
• Isolate any macOS endpoint showing the IOC set; preserve a forensic image before reimaging.
• Force-rotate any credentials, keychain items, or session tokens present on a confirmed-infected host; assume login.keychain-db is compromised.

P2 — within 72 hours (remediation)

• Remove the LaunchAgent plist and the implant binary; verify no residual artefacts in temp/collected_data.zip paths or in user ~/Library directories.
• Pin or block outbound api.telegram.org Bot API traffic at the egress proxy for endpoints that have no business need; allow-list only sanctioned Telegram integrations.
• Update Apple XProtect definitions to the latest; confirm the MACOS_BONZAI_COBUCH and AIRPIPE rules are active.
• For SOC/IR pipelines that use LLM-assisted triage: ensure hostile sample output (the {{DATA}}-delimited Markdown blob) is stripped or sandboxed before reaching the model; treat sample contents as adversarial input, never as instructions.

P3 — within 7 days (hardening)

• Enable macOS notarisation / Gatekeeper enforcement and block ad hoc–signed binaries from launching where policy permits.
• Restrict IOPMAssertionCreateWithName abuse via EDR rules that flag long-lived power assertions from non-Apple binaries.
• Add EDR rules to alert on dlsym-resolved API calls combined with __NSGetExecutablePath use from non-Apple binaries.
• Review and tighten supply-chain controls covering runtime interpreter staging (e.g. block astral-sh/python-build-standalone fetches from non-build hosts) and consumer messaging APIs as C2 channels.

5. Indicators of compromise

sha256  6328567511d88fdc2ae0939c5ef17b7a63d2a833881900de018a4f12f4982525
sha256  77b4fd46994992f0e57302cfe76ed23c0d90101381d2b89fc2ddf5c4536e77ca
sha256  baabf249c77bc54c54ab0e66e15af798bd28aa5b4683554456a8b73ab8741239
sha256  b3c56d689414343589f38394d19ba2fe9a518133281200faa0556ba4e4136394
signing-identifier  endpoint-macos-aarch64-5555494492fc075f441637fb9d894913dde3a2ea
launchagent-label  com.apple.system.services.activity
xprotect-rule  MACOS_BONZAI_COBUCH
xprotect-rule  AIRPIPE
domain  api.telegram.org
domain  astral-sh.github.io

6. Detection

rule macOS_Gaslight_Rust_Backdoor
{
    meta:
        author = "Adverse Trace"
        date = "2026-06-24"
        reference = "https://www.sentinelone.com/labs/macos-gaslight-rust-backdoor-turns-prompt-injection-on-the-analyst-not-the-sandbox/"
        description = "macOS.Gaslight Rust backdoor — ad hoc signing identifier, LaunchAgent label, XProtect rule names, and analyst-targeting prompt-injection scaffold"
    strings:
        $signing_id = "endpoint-macos-aarch64-5555494492fc075f441637fb9d894913dde3a2ea" ascii wide
        $launchd_label = "com.apple.system.services.activity" ascii wide
        $xrule1 = "MACOS_BONZAI_COBUCH" ascii wide
        $xrule2 = "AIRPIPE" ascii wide
        $pyver = "PY_VERSION=3.10.18" ascii
        $builddate = "BUILD_DATE=20250708" ascii
        $aesgcm = "aes-gcm 0.10.3" ascii
        $redact = "file/token:redacted" ascii
        $data_tok = "{{DATA}}" ascii wide
        $persist = "persist_enable" ascii
        $initpy = "init_python_enable" ascii
        $tgroom = "tg_room_id" ascii
        $aeskey = "aes_key" ascii
        $ghrepo = "github_repo" ascii
        $ghtoken = "github_token" ascii
        $ghpoll = "github_polling_interval" ascii
        $payload_macos = "payload_path_macos" ascii
        $persist_name_macos = "persist_name_macos" ascii
        $persist_type_macos = "persist_type_macos" ascii
        $err_blocked = "BotBlocked" ascii wide
        $err_invalid = "InvalidToken" ascii wide
        $err_conflict = "Conflict" ascii wide
        $attach = "attach://" ascii wide
    condition:
        // signing identifier OR launchagent label OR (xprotect rule pair AND any two config fields)
        $signing_id or $launchd_label or
        (1 of ($xrule*) and 2 of ($persist, $initpy, $tgroom, $aeskey, $ghrepo, $ghtoken, $ghpoll, $payload_macos, $persist_name_macos, $persist_type_macos))
}

title: macOS.Gaslight LaunchAgent Persistence
id: 8c1f3a2e-macos-gaslight-launchagent
status: experimental
description: >
    Detects creation of a macOS LaunchAgent with the macOS.Gaslight Label
    com.apple.system.services.activity, or any LaunchAgent whose ProgramArguments
    resolves to a binary matching the Gaslight ad hoc signing identifier.
author: Adverse Trace
date: 2026-06-24
reference: https://www.sentinelone.com/labs/macos-gaslight-rust-backdoor-turns-prompt-injection-on-the-analyst-not-the-sandbox/
logsource:
    product: macos
    category: process_creation
detection:
    selection_launchctl:
        Image|endswith: launchctl
        CommandLine|contains: load
        CommandLine|contains: com.apple.system.services.activity
    selection_label:
        CommandLine|contains: com.apple.system.services.activity
    condition: selection_launchctl or selection_label
level: high
tags:

    - attack.persistence
    - attack.t1543.001
---
title: macOS.Gaslight Telegram Bot API C2
id: 8c1f3a2e-macos-gaslight-telegram-c2
status: experimental
description: >
    Detects non-browser, non-sanctioned-Telegram-client processes on macOS
    contacting the Telegram Bot API (api.telegram.org) — the channel used by
    macOS.Gaslight for C2 and exfiltration.
author: Adverse Trace
date: 2026-06-24
reference: https://www.sentinelone.com/labs/macos-gaslight-rust-backdoor-turns-prompt-injection-on-the-analyst-not-the-sandbox/
logsource:
    product: macos
    category: dns_query
detection:
    selection_domain:
        QueryName|endswith: api.telegram.org
    filter_known_clients:
        Image|endswith:

            - "/Telegram.app/Contents/MacOS/Telegram"
            - "/Telegram Desktop.app/Contents/MacOS/Telegram"
    condition: selection_domain and not filter_known_clients
level: high
tags:

    - attack.command_and_control
    - attack.t1071.001

Threat actor context

Lazarus Group · G0032 · aka Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. …

No MITRE ATT&CK profile for: DPRK.

7. Sources

• SentinelOne Labs / SentinelLABS — macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox — https://www.sentinelone.com/labs/macos-gaslight-rust-backdoor-turns-prompt-injection-on-the-analyst-not-the-sandbox/ — 2026-06-23

8. Adverse Trace position

macOS.Gaslight is a credible, well-engineered macOS implant whose tradecraft — Telegram Bot API C2, AES-GCM with certificate pinning, keychain theft, LaunchAgent persistence — is established, but whose analyst-targeting prompt-injection cascade is novel and operationally significant for any SOC that has folded LLM-assisted triage into its reverse-engineering loop. Severity for affected EMEA financial services firms is high where macOS endpoints host privileged credentials, trading or treasury workstations, or analyst workstations whose output feeds AI-assisted detection; elsewhere it is medium. Attribution to DPRK-aligned activity is reported by SentinelLABS with high confidence but, per our reference data, "DPRK" has no MITRE ATT&CK profile and is therefore treated as unconfirmed. We will next (i) monitor for additional samples and any recovery of the runtime-supplied aes_key or Telegram bot token, (ii) track whether the focus verb and the persistence/Python-staging branches are confirmed in follow-on reporting, and (iii) update this advisory if Apple XProtect rule coverage expands beyond hash-based detection.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.