macOS.Gaslight — North Korea-Aligned Rust Backdoor & Infostealer

macOS.Gaslight is a Rust-based macOS backdoor and infostealer attributed with high confidence to North Korea-aligned actors and first reported around 2026-06-25 by SentinelOne Labs. The implant ships as an ad-hoc-signed aarch64 Mach-O, persists as a LaunchAgent whose label com.apple.system.services.activity deliberately impersonates Apple's own namespace, and uses the Telegram Bot API (getUpdates polling) wrapped in AES-GCM over certificate-pinned TLS as its command-and-control channel. Operators drive it with a small verb set — help, id, shell, kill, upload, stop (and an apparent 7th, focus).

The codename "Gaslight" comes from its analyst-deception payload: a 3.5 KB blob of 38 fabricated "system" messages delimited by {{DATA}} tokens, designed to mislead an LLM that ingests the sample during triage. This is a defense-evasion technique aimed at the analyst's tooling, not the sandbox — treat any AI-assisted verdict on this family as untrusted and corroborate with raw telemetry.

The infostealer stage base64-decodes a Python script that downloads a standalone CPython 3.10.18 runtime (from astral-sh/python-build-standalone) into user space and runs it to harvest browser data (Chrome, Brave, Firefox, Safari), terminal histories, the installed-apps list, running processes (ps aux), the system profile (system_profiler), and login.keychain-db, archiving everything to temp/collected_data.zip for exfil.

Defender priority: CrowdStrike Falcon covers macOS. The two highest-fidelity, lowest-FP catches are (1) a LaunchAgent plist written with the com.apple.system.services.activity label outside an Apple-signed installer, and (2) a non-Apple process reading login.keychain-db together with ps aux / system_profiler in a tight window. Hunt those first; the listed SHA256 hashes are exact-match backstops.

Web-hunter note: Four sources, one primary vendor teardown plus three corroborating outlets — high confidence. Per the cited intel, the runtime config params (tg_room_id, aes_key, main_base_url, main_upload_url) and bot tokens are NOT embedded in the sample (supplied at runtime; tokens self-redacted as file/token:redacted), so there is no static C2 string or bot token to IOC. Network detection anchors on the Telegram API host. No victim/sector names are reproduced here.

Hunt hypotheses (fidelity-ordered)

1. H1 (high): A LaunchAgent plist carrying the label com.apple.system.services.activity is created by a non-Apple process — Gaslight persistence masquerading in Apple's namespace.
2. H2 (high): A non-Apple process reads login.keychain-db and, in a tight window, also runs ps aux and system_profiler — the infostealer collection burst.
3. H3 (high): A standalone python3 / cpython-3.10.18 binary executes from a user-writable path (not /usr/bin) — the downloaded CPython runtime that runs the stealer.
4. H4 (medium): A shell pipeline base64 -d / base64 --decode feeds decoded content into python3 — staged deobfuscation of the infostealer (T1140).
5. H5 (medium): A macOS host makes outbound connections to api.telegram.org from a non-browser, non-messaging process — Telegram Bot API C2 polling.
6. H6 (high): Any process whose image SHA256 matches one of the four listed Gaslight/BONZAI/script hashes — exact-match backstop.

Attack chain

Note: No bot token or C2 URL is published — they are self-redacted (file/token:redacted) and supplied at runtime. api.telegram.org is a legitimate host; alert only on the behavioral combination (non-browser/non-messaging process), never on the domain alone.

Direct host checks that complement the Falcon CQL queries — run on suspect macOS endpoints or fold into an MDM/osquery sweep.

1 · Hunt the masquerading LaunchAgent (read-only)

grep -lR "com.apple.system.services.activity" \
  ~/Library/LaunchAgents /Library/LaunchAgents 2>/dev/null
# Legitimate Apple LaunchAgents live under /System/Library/LaunchAgents and are SIP-protected;
# a plist with this label under a user/Library path is suspicious.

2 · osquery — non-Apple LaunchAgents referencing the label

SELECT name, path, program, program_arguments
FROM launchd
WHERE name LIKE '%com.apple.system.services.activity%'
  AND path NOT LIKE '/System/Library/%';

3 · Find a downloaded standalone CPython runtime in user space

find ~ /Users/Shared /tmp /var/folders -type d -name "cpython-3.10.18*" 2>/dev/null
# astral-sh/python-build-standalone runtime staged outside a developer toolchain is anomalous.

4 · Spot the staged collection archive

find ~ /tmp /var/folders -type f -name "collected_data.zip" 2>/dev/null

Reminder: Do not paste the live sample into an LLM triage tool — the 38-message prompt-injection blob is designed to corrupt AI-assisted verdicts. Corroborate against raw telemetry.

All queries target macOS telemetry. Falcon's macOS plist-write and keychain-read field names vary by sensor build — fields flagged ⚠ below should be validated in your tenant before promotion.

// HUNT: macOS LaunchAgent masquerading as com.apple.system.services.activity
// MITRE: T1547.015
// CONF: high  FP: low  COST: low | REQUIRES: macOS file-write telemetry (LaunchAgents)
// FALSE POSITIVES: approved MDM/EDR agents that reuse the label (rare)
// TUNING: exclude known-good ImageFileName installers if any legitimately write this label
// NOTE: macOS plist-write field set varies by sensor build - validate TargetFileName emission in tenant
#event_simpleName=/NewExecutableWritten|FileRename/
| TargetFileName=/LaunchAgents\/.*com\.apple\.system\.services\.activity.*\.plist$/i
| TargetFileName!=/^\/System\/Library\//
| table([ComputerName, UserName, ImageFileName, TargetFileName, SHA256HashData], limit=200)

// HUNT: macOS infostealer collection - keychain + recon command burst
// MITRE: T1555 / T1056.004 / T1005
// CONF: high  FP: medium  COST: medium | REQUIRES: ProcessRollup2 (macOS) CommandLine
// FALSE POSITIVES: admin/IT scripts running system_profiler or ps aux; backup tools touching keychain
// TUNING: exclude approved inventory/backup agents by ImageFileName
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/login\.keychain-db|system_profiler|ps\s+aux/i
| table([ComputerName, UserName, ImageFileName, ParentBaseFileName, CommandLine], limit=200)

// HUNT: macOS downloaded standalone CPython 3.10.18 running the stealer
// MITRE: T1059.006
// CONF: high  FP: medium  COST: low | REQUIRES: ProcessRollup2 (macOS) ImageFileName
// FALSE POSITIVES: developers using python-build-standalone / pyenv
// TUNING: exclude known dev build roots (.pyenv, project venvs) by path
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ImageFileName=/cpython-3\.10\.18.*\/(bin\/)?python3?$/i
| ImageFileName!=/\/\.pyenv\//
| table([ComputerName, UserName, ImageFileName, ParentBaseFileName, CommandLine, SHA256HashData], limit=200)

// HUNT: macOS base64-decode piped into python (staged deobfuscation)
// MITRE: T1140 / T1059.006
// CONF: medium  FP: medium  COST: low | REQUIRES: ProcessRollup2 (macOS) CommandLine
// FALSE POSITIVES: legitimate installers/CI that decode-and-run
// TUNING: exclude approved CI/build agents by ParentBaseFileName
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/base64\s+(-d|--decode)/i
| CommandLine=/python3?/i
| table([ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine], limit=200)

// HUNT: macOS Telegram Bot API C2 from non-browser process
// MITRE: T1041 / T1102
// CONF: medium  FP: medium  COST: medium | REQUIRES: DnsRequest (macOS)
// FALSE POSITIVES: Telegram desktop client; dev tooling using the Bot API
// TUNING: exclude browsers + approved messaging clients by ContextBaseFileName
#event_simpleName=DnsRequest
| DomainName=/^api\.telegram\.org$/i
| ContextBaseFileName!=/^(Telegram|Safari|Google Chrome|firefox|com\.apple\.WebKit|Brave Browser)/i
| table([ComputerName, DomainName, ContextBaseFileName, ContextProcessId], limit=200)

// HUNT: macOS Gaslight known-bad SHA256 (exact match)
// MITRE: T1204 / multiple
// CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2 (macOS) SHA256HashData
// FALSE POSITIVES: none (exact hash match)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| SHA256HashData=/^(6328567511d88fdc2ae0939c5ef17b7a63d2a833881900de018a4f12f4982525|77b4fd46994992f0e57302cfe76ed23c0d90101381d2b89fc2ddf5c4536e77ca|baabf249c77bc54c54ab0e66e15af798bd28aa5b4683554456a8b73ab8741239|b3c56d689414343589f38394d19ba2fe9a518133281200faa0556ba4e4136394)$/i
| table([ComputerName, UserName, ImageFileName, CommandLine, SHA256HashData], limit=200)

Promotion path: Q1 and Q6 are clean enough for Detect-and-Block IOAs / IOC import today. Q2–Q5 should run as scheduled-search hunts first, baseline benign triggers for 7–14 days, then promote with the noted exclusions.

One-click blocks for SOC ingestion. All atomic indicators below trace to the cited SentinelOne Labs teardown (and corroborating outlets) — no values were invented.

type,value,action,severity,expiration,description,tags
sha256,6328567511d88fdc2ae0939c5ef17b7a63d2a833881900de018a4f12f4982525,prevent,critical,2026-12-27,Gaslight Rust implant,campaign:Gaslight
sha256,77b4fd46994992f0e57302cfe76ed23c0d90101381d2b89fc2ddf5c4536e77ca,prevent,critical,2026-12-27,Gaslight BONZAI sample,campaign:Gaslight
sha256,baabf249c77bc54c54ab0e66e15af798bd28aa5b4683554456a8b73ab8741239,prevent,high,2026-12-27,Gaslight Python infostealer,campaign:Gaslight
sha256,b3c56d689414343589f38394d19ba2fe9a518133281200faa0556ba4e4136394,prevent,high,2026-12-27,Gaslight bash installer,campaign:Gaslight
domain,api.telegram.org,detect,medium,2026-09-27,Telegram Bot API C2 (context-only),campaign:Gaslight

LaunchAgent label   : com.apple.system.services.activity (non-/System/Library writer)
Ad-hoc signing ID   : endpoint-macos-aarch64-5555494492fc075f441637fb9d894913dde3a2ea
Collection archive  : temp/collected_data.zip
Runtime CPython     : cpython-3.10.18 (PY_VERSION=3.10.18, BUILD_DATE=20250708)
Recon burst         : login.keychain-db + system_profiler + ps aux
C2 pattern          : api.telegram.org getUpdates polling, AES-GCM over pinned TLS
Runtime config keys : tg_room_id, aes_key, main_base_url, main_upload_url (not embedded)
Anti-analysis       : 3.5KB / 38-message {{DATA}}-delimited prompt-injection blob; dlsym; IOPMAssertionCreateWithName

Family       : macOS.Gaslight (Rust backdoor + infostealer)
Sibling      : BONZAI
Platform     : macOS aarch64 (ARM64) + x86_64, ad-hoc signed
Attribution  : North Korea-aligned (high confidence)
C2 transport : Telegram Bot API
Operator cmds: help, id, shell, kill, upload, stop, focus(7th)
Reported     : ~2026-06-25 (SentinelOne Labs)

[ ] Block the 4 SHA256 via Falcon IOC Management (prevent)
[ ] Alert on non-Apple writers of com.apple.system.services.activity LaunchAgent
[ ] Restrict keychain access; enforce Gatekeeper + require notarization (block ad-hoc signed)
[ ] MDM allowlist LaunchAgents; flag user-Library plists with com.apple.* labels
[ ] Egress policy / DNS logging for api.telegram.org from managed macOS fleet
[ ] Analyst policy: never feed live samples to LLM triage tools (prompt-injection blob)

⚠ Tenant-validation: Falcon macOS field emission for LaunchAgent plist writes and login.keychain-db reads varies by sensor build. Validate that TargetFileName populates for Q1 and that keychain file access is captured before relying on Q2's keychain leg.

1 · Fleet sweep — masquerading LaunchAgent (MDM / SSH read-only check)

#!/bin/bash
# Detect Gaslight LaunchAgent persistence across user + /Library scopes (read-only).
LABEL="com.apple.system.services.activity"
for d in /Library/LaunchAgents /Users/*/Library/LaunchAgents; do
  [ -d "$d" ] || continue
  grep -lR "$LABEL" "$d" 2>/dev/null
done
# Any hit OUTSIDE /System/Library is suspicious - legitimate Apple agents are SIP-protected.

2 · Falcon IOC Management — block the published hashes

# Import the CSV from Section 10 (type,value,action,severity,expiration,description,tags)
# via Falcon console: Endpoint security > IOC Management > Add indicators > Upload CSV.
# All four sha256 set to action=prevent. Re-confirm expiration on review (+6mo from 2026-06-27).

3 · MDM configuration profile — require notarization (block ad-hoc signed)

# Gatekeeper assessment must be enabled; deploy via your MDM as a custom profile or
# enforce with the com.apple.systempolicy.control payload. Verify on an endpoint:
spctl --status                 # expect: assessments enabled
spctl -a -vv /path/to/suspect  # ad-hoc signed binaries report "rejected" / no notarization

4 · osquery scheduled pack — staged stealer artifacts

{
  "schedule": {
    "gaslight_cpython": {
      "query": "SELECT path FROM file WHERE path LIKE '/Users/%/cpython-3.10.18%';",
      "interval": 3600
    },
    "gaslight_archive": {
      "query": "SELECT path, size FROM file WHERE filename = 'collected_data.zip';",
      "interval": 3600
    }
  }
}

Validation: 6 CQL queries cover 7 of 8 mapped behaviors. Residual gap: the anti-analysis tradecraft (prompt-injection blob, dlsym dynamic resolution, IOPMAssertion sleep-prevention) generates little discrete EDR telemetry and is addressed by the hash backstop (Q6) plus the analyst-tooling policy in Section 12. Validate Q1's TargetFileName emission and Q2's keychain-read leg in your tenant before promoting to Block.

Generated 2026-06-27 · HuntPack v0.1 · Defensive content only (hunt / detect / harden). All atomic IOCs trace to the cited sources; no indicators were fabricated.