macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox

What it is

macOS.Gaslight is an ad hoc–signed, Rust-written Mach-O implant and infostealer for macOS aarch64, carrying the code-signing identifier endpoint-macos-aarch64-5555494492fc075f441637fb9d894913dde3a2ea. It was uploaded to VirusTotal on May 22 and surfaced via an Apple XProtect update in early June. SentinelLABS assesses with high confidence it belongs to a DPRK-aligned macOS cluster.

How it works

C2 is a Telegram Bot API getUpdates polling loop that runs only when no webhook is registered. The dispatch handler keys on three error codes — BotBlocked, InvalidToken, Conflict — and treats a Conflict (two instances polling one token) as an implicit single-instance lock, so a second copy self-terminates. Payloads use AES-GCM (pure-Rust aes-gcm 0.10.3) with a fresh per-message nonce from CCRandomGenerateBytes. It sets a custom trust anchor via SecTrustSetAnchorCertificatesOnly (cert pinning) yet still reads system proxy config via SCDynamicStoreCopyProxies, so it evades proxy-CA inspection while working through enforced enterprise proxies. An IOPMAssertionCreateWithName assertion blocks sleep to sustain long-running polling. The operator gets an interactive shell exposing six verbs across two menus, with weak evidence of a seventh (focus).

Preconditions / Affected

The aes_key, bot token, and tg_room_id are supplied at runtime and absent from this sample — analysis is static only. The 15-field serde config schema is baked into the binary as plaintext and includes Linux- and GitHub-related fields (github_token, github_repo, payload_path_linux, persist_name_linux, etc.) that this sample never exercises, indicating a broader cross-platform toolset behind the same operator interface.

What to do

• Detection: Apple XProtect flags the sample under rule MACOS_BONZAI_COBUCH; a sibling BONZAI sample is caught by the AIRPIPE rule. XProtect matches on hash only, not internal strings — so it will not catch recompiled variants.
• Hunt on host artifacts rather than network content: the Python stealer harvests Chrome, Brave, Firefox, and Safari data, terminal histories, installed-app listings, ps aux process snapshots, system_profiler output, and a raw copy of login.keychain.
• Do not rely on TLS interception — the pinned anchor rejects proxy-CA MITM. Look instead for Telegram Bot API polling and the plaintext serde field names above in the binary.

Caveats

The sample remained undetected by static engines on VirusTotal at the time of writing despite the XProtect coverage. Because config and keys are runtime-supplied, the actual C2 endpoint, chat room, and AES key are not recoverable from this binary. The seventh command focus could not be fully characterized.