macOS.Gaslight — DPRK-aligned Rust Backdoor & Infostealer with Analyst-Targeting Prompt-Injection Anti-Analysis (Telegram Bot API C2) — Threadlinqs Intelligence
As of 2026-06-23, macOS.Gaslight — DPRK-aligned Rust Backdoor & Infostealer with Analyst-Targeting Prompt-Injection Anti-Analysis (Telegram Bot API C2) is a high-severity malware threat attributed to DPRK-aligned activity cluster (North Korea), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 25 indicators of compromise.
Threat ID: TL-2026-0920 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: DPRK-aligned activity cluster · North Korea · FINANCIAL
macOS.Gaslight is a Rust-based persistent backdoor and infostealer for macOS, attributed with high confidence to DPRK-aligned activity. It is notable for a novel anti-analysis technique: a 3.5 KB blob
macOS.Gaslight is a Rust-compiled, ad-hoc-signed Mach-O implant for macOS (aarch64 primary; the staged Python stealer also supports x86_64) analyzed by SentinelLABS and published on 23 June 2026. SentinelLABS attributes the sample to a DPRK-aligned activity cluster with HIGH confidence based on Apple XProtect detection under the MACOS_BONZAI_COBUCH rule (the BONZAI signature family is associated by SentinelLABS with North Korean operations) and a sibling sample detected by the AIRPILE rule, also tied to DPRK activity. The malware sits within the lineage of DPRK macOS tooling such as RustBucket, KandyKorn, and NimDoor.
The defining feature of macOS.Gaslight is an analyst-targeting prompt-injection payload: a ~3.5 KB Markdown-fenced blob containing 38 fabricated 'system' messages that imitate an LLM triage harness scaffold using {{DATA}} delimiters. The fake messages describe token expiry, out-of-memory kills, disk exhaustion, injection vulnerabilities, and static-analysis flags, with the objective of pushing an LLM agent into aborting, truncating, or refusing analysis. SentinelLABS characterizes this as the first documented harness-spoofing cascade — earlier samples used single injected blocks — and notes the implant 'attacks the agent's perception, rather than the sandbox it runs in.' Notably absent are conventional anti-analysis tricks such as VM detection, debugger evasion, or sandbox-specific behavior.
For command and control, the Rust core uses a Telegram Bot API getUpdates polling loop, with single-instance locking achieved via the Telegram Conflict error response. It exposes an interactive shell with six verbs (help, id, shell, kill, upload, stop) plus evidence of a seventh 'focus' command. Transport security uses the aes-gcm 0.10.3 crate for AES-GCM payload encryption with a fresh nonce per message generated via CCRandomGenerateBytes, an AES key supplied at runtime (not embedded), and certificate pinning via SecTrustSetAnchorCertificatesOnly to block standard proxy CA interception while still honoring system proxy settings via SCDynamicStoreCopyProxies. Runtime behavior is driven by a 15-field serde configuration schema (tg_room_id, github_token, github_repo, github_polling_interval, main_upload_url, main_base_url, aes_key, payload_path_linux, payload_path_macos, persist_name_linux, persist_name_macos, persist_type_linux, persist_type_macos, init_python_enable, persist_enable). The presence of Linux and GitHub fields not exercised in the sample indicates a broader, cross-platform operator toolkit. An OPSEC feature redacts the bot token in runtime output when a URL path contains the bytes for 'file' (0x656c6966 little-endian), substituting the placeholder 'file/token:redacted' to prevent token recovery from logs and crash artifacts.
The implant resolves APIs at runtime via dlsym (avoiding the static symbol table), locates its own executable via __NSGetExecutablePath, executes processes with execvp (with a posix_spawnp alternative), and creates an IOPMAssertionCreateWithName power-management assertion to prevent system sleep during polling/collection. Persistence is via a LaunchAgent labeled com.apple.system.services.activity (masquerading within the com.apple.* namespace), written with an absolute executable path and gated by the persist_enable serde field.
Data collection is handled by a base64-encoded Python stealer (~6.6 KB encoded) staged at runtime by a ~2 KB bash installer. The installer fetches a standalone CPython runtime (Python 3.10.18, build 20250708) from the astral-sh/python-build-standalone project, supporting arm64 and x86_64. The stealer collects Chrome, Brave, Firefox, and Safari browser data; terminal command histories; installed application lists; running processes (ps aux); a system profile (system_profiler); and a raw copy of login.keychain-db. Collected data is archived to temp/collected_data.zip and uploaded via the Telegram multipart attach mechanism. Widespread emoji use and strict comment he
Target sectors: cryptocurrency, blockchain, financial, technology, web3
Target regions: Global, North America, Europe, Asia
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 25 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1587, T1204, T1059, T1059, T1106, T1543, T1036, T1036, T1027, T1140