Remediation
macOS Gaslight Rust Backdoor Weaponizes Prompt Injection Against Analysts
Immediate Containment
! Unload and remove ~/Library/LaunchAgents/com.apple.system.services.activity.plist via launchctl bootout gui/<uid>/.
! Kill running Gaslight binary processes and any orphaned python-build-standalone interpreter instances.
! Isolate compromised macOS endpoints from corporate network to block Telegram C2 communication.
Exposure Reduction & Patching
🛡️ Block outbound access to api.telegram.org from non-sanctioned client binaries at perimeter proxies.
🛡️ Enforce strict Apple code-signing policies prohibiting execution of ad-hoc signed unsigned Mach-O binaries.
📦 Ensure macOS endpoints are updated to latest macOS versions with Gatekeeper and XProtect signatures enabled.
Configuration & Credentials
⚙️ Enable EDR tamper protection and alerts on user LaunchAgent creation.
⚙️ Deploy MDM configuration profiles restricting accessibility and keychain database access permissions.
🔑 Force complete password and session revocation for all accounts saved in victim user browser profiles.
🔑 Rotate all personal and enterprise credentials stored in affected login.keychain-db.
Evidence Preservation
📁 Acquire forensic memory image and preserve disk image of ~/Library/LaunchAgents/ and user temp directories prior to remediation.
Verification & Rollback
✓ Verify that com.apple.system.services.activity is no longer listed in launchctl list.
✓ Confirm no residual standalone Python directories exist in /tmp.
↩️ Rollback: Retain configuration backups of LaunchAgents prior to mass removal scripts.