macOS Gaslight Rust Backdoor Weaponizes Prompt Injection Against Analysts
Executive summary
SentinelLabs disclosed macOS.Gaslight, a sophisticated persistent backdoor written in Rust that targets macOS workstations. The malware bundles interactive remote shell capabilities, a Python-based credential stealer, and Telegram command-and-control with bot token self-redaction. Uniquely, macOS.Gaslight embeds a 38-message prompt injection scaffold formatted with Markdown and delimiter tokens specifically designed to subvert LLM-assisted analyst triage pipelines.
Technical analysis
macOS.Gaslight relies on dynamic API resolution via dlsym and dynamically recovers its executable path via __NSGetExecutablePath to register a persistence plist with label com.apple.system.services.activity under ~/Library/LaunchAgents. The operator configuration is structured via a 15-field serde schema. The implant deploys a base64-encoded bash script that downloads a standalone CPython interpreter (version 3.10.18) to execute an uncompiled data collection script targeting login.keychain-db, Chrome, Brave, Firefox, and Safari data. Anti-analysis tradecraft includes a Telegram URL constructor that overwrites API tokens with 'file/token:redacted' and a 3.5 KB prompt-injection block containing fake system alerts intended to deceive AI-driven triage harnesses.
IOCs
CVEs and affected products
No CVE or affected product is available.
ATT&CK mapping
Launch Agent
Tactic: Persistence
Web Protocols
Tactic: Command and Control
Credentials from Web Browsers
Tactic: Credential Access
Detection content
Sigma rules, YARA rules, Splunk SPL, and KQL detection logic.
Threat hunting
Hypothesis-driven hunt procedures and telemetry checklist.
Remediation
Containment actions, patching notes, and credential steps.
Historical relationships
No published historical relationship is available.
Timeline and change history
Confidence and caveats
0.95
⚠️ This report is based on static and dynamic reverse-engineering findings of public samples.
⚠️ No private enterprise incidents are included.
📄
Intelligence Sources & Advisory Feeds
DFIR investigations, vendor research, advisory feeds & verified claims
3 references
▼
Evidence is sourced directly from SentinelLabs primary research, detailing confirmed Mach-O hashes, signing identifiers, LaunchAgent plists, and reverse-engineered binary configuration structures.
SentinelLabs research documented macOS Gaslight Rust backdoor weaponizes prompt injection against analysts reading automated sample triage outputs and AI-assisted reverse engineering pipelines.
The Mach-O sample 6328567511d88fdc2ae0939c5ef17b7a63d2a833881900de018a4f12f4982525 establishes persistence via LaunchAgent label com.apple.system.services.activity and stages Python stealer baabf249c77bc54c54ab0e66e15af798bd28aa5b4683554456a8b73ab8741239.
The implant features hardened Telegram bot C2 communications with self-redaction placeholder file/token:redacted, fetching standalone CPython 3.10.18 interpreters to steal credentials from login.keychain-db and web browsers.