Hunt

macOS Gaslight Rust Backdoor Weaponizes Prompt Injection Against Analysts

Hunt Strategy & Objective

Detect execution of the macOS.Gaslight Rust backdoor, rogue LaunchAgents, and unauthorized Telegram C2 channels.

⏱️ Lookback: 60 days

Hunt Hypothesis

Threat actors deployed macOS.Gaslight Mach-O binaries establishing persistence in LaunchAgents and staging Python runtime environments to exfiltrate user keychains.

Target Platforms & Environment

macOS

All enterprise macOS endpoints (x86_64 and arm64 architectures).

Required Telemetry & Data Sources

Endpoint Detection & Response (EDR) LaunchAgent plist auditing DNS and NetFlow logs

✓ Operational Execution Phases

2 Structured Investigation Phases

Persistence & Configuration Review

macOS unified logs EDR filesystem events

🎯 Phase Goal: Identify masquerading LaunchAgent plists and runtime artifacts.

Procedural Actions

1.1 Scan user directories for com.apple.system.services.activity.plist.
1.2 Verify code signature of binaries referenced in ProgramArguments.

Phase Hunting Logic & Queries

spl Detect Gaslight Plist Installation

index=endpoint file_path="*/Library/LaunchAgents/com.apple.system.services.activity.plist" | table _time, host, user

💡 Tuning & Baselines: Alert immediately on match

Anomaly Confirmation & Pivot Guidance

↪ Extract the binary path from the plist and check its execution history.

C2 & Exfiltration Telemetry Correlation

Network proxy logs Process network connection events

🎯 Phase Goal: Detect exfiltration of collected credentials over Telegram C2.

Procedural Actions

2.1 Correlate endpoint process execution with outbound HTTPS sessions to Telegram Bot API.
2.2 Identify archiving of login.keychain-db and browser sqlite stores.

Phase Hunting Logic & Queries

spl Telegram Bot API Outbound Data Transfers

index=proxy dest_host="api.telegram.org" method=POST bytes_out>50000 | table _time, src_ip, user, bytes_out

💡 Tuning & Baselines: Exclude verified administrative Telegram desktop usage

Anomaly Confirmation & Pivot Guidance

↪ Isolate the originating macOS host and review keychain access logs.

✓

True Positive Confirmation Evidence

● Plist file ~/Library/LaunchAgents/com.apple.system.services.activity.plist

● Outbound HTTPS POST requests to api.telegram.org with payload temp/collected_data.zip

● Execution of standalone python-build-standalone interpreters

Benign & False Positive Explanations

● Legitimate Apple system services (differentiated by checking code signature and installation paths outside ~/Library/LaunchAgents/).

🔬 Forensic Artifacts to Collect & Preserve

~/Library/LaunchAgents/com.apple.system.services.activity.plist

/tmp/temp/collected_data.zip

Ad-hoc signed Mach-O binary

Validation Checklist

Verify code signing of running binary via codesign -dvvv.

Inspect contents of com.apple.system.services.activity.plist ProgramArguments.

Escalation Criteria

Detection of com.apple.system.services.activity or unauthorized extraction of login.keychain-db.

Traceability & Related Detections

🔍 Evidence: 78dcb556-a5… 🔍 Evidence: 09d15387-fc… 🔍 Evidence: 41364a28-d8… 🛡️ Detection: 40fafacd-92… 🛡️ Detection: ca4fbebb-17…