Tia N.List

Reported by 2 outlets

macOS.Gaslight — Rust Backdoor Weaponizes Prompt Injection Against the Analyst, Not the Sandbox

hot0.0
Why this score
Breadth
1.00 / 2.0 · 2 sources
Authority
1.00 / 2.0 · best outlet weight
Severity
0.50 / 5.0 · CVSS + content signals
Velocity
0.00 / 2.0 · updates in 48h
Pickup speed
0.00 / 0.6 · time to second source
Recency
× 0.00 temporal multiplier
Community
+ 0.00 / 1.5 · reddit signal
Score
0.0 / 10 = base × recency + community
sentinelone.comhaunted.lighthouse.co.im first seen 112d ago

Analysis

SentinelLABS disclosed macOS.Gaslight, a Rust-based macOS implant that uses a Telegram Bot API for command and control with AES-GCM payloads over certificate-pinned TLS. The implant carries a 3.5 KB cascade of 38 fabricated system messages designed to poison LLM-assisted triage pipelines, steering analysts to abort or refuse analysis. A Python-based stealer is fetched at runtime (standalone CPython 3.10.18), then harvests login.keychain-db and browser data from Chrome, Brave, Firefox, and Safari. Persistence is a LaunchAgent masquerading as com.apple.system.services.activity. The event also notes FLATROOF (aka macOS.Gaslight) was separately documented carrying a payload. SentinelLABS assesses high confidence this is DPRK-aligned activity, detected by XProtect as MACOS_BONZAI_COBUCH.

Timeline

  1. original reporting

    macOS.Gaslight — Rust Backdoor Weaponizes Prompt Injection Against the Analyst, Not the Sandbox

    sentinelone.com · 112d ago · June 24th, 2026

    SentinelLABS disclosed macOS.Gaslight, a Rust-based macOS implant that embeds a 3.5 KB cascade of 38 fabricated "system" messages designed to steer LLM-assisted triage pipelines into aborting or refusing analysis. The implant communicates over a Telegram Bot API polling loop with AES-GCM payloads over certificate-pinned TLS, and self-redacts its bot token at runtime to prevent credential recovery from crash logs.

    Key capabilities: interactive shell via Telegram C2, a Python-based stealer (fetches a standalone CPython 3.10.18 at runtime from astral-sh/python-build-standalone), credential harvesting (login.keychain-db, browser data from Chrome/Brave/Firefox/Safari), and persistence via a LaunchAgent masquerading as com.apple.system.services.activity. SentinelLABS assesses with high confidence that this implant belongs to a cluster of DPRK-aligned macOS activity (XProtect detects under rule MACOS_BONZAI_COBUCH).

    The analyst-targeting injection is notable: 38 fake system messages about token expiry, OOM kills, disk exhaustion, and injection warnings — designed to poison LLM-assisted reverse engineering pipelines. Anyone building such tooling should treat sample contents as adversarial input.

  2. update from haunted.lighthouse.co.im

    3/3 There's a second thread: the same malware family (FLATROOF, aka macOS.Gaslight) was separately documented carrying a payload built to fo

    haunted.lighthouse.co.im · 19d ago · September 24th, 2026

    3/3 There's a second thread: the same malware family (FLATROOF, aka macOS.Gaslight) was separately documented carrying a payload built to fo

    via Mastodon https://haunted.lighthouse.co.im/articles/whatever-their-laptop-can-reach/

Source on GitHub