ctipilot.ch

macOS.Gaslight

tool · tool:macos-gaslight

macOS.Gaslight — DPRK-aligned Rust backdoor with anti-analyst prompt injection

Coverage timeline
2
first 2026-06-26 → last 2026-06-29
Peak priority
high
2 high
Sources cited
7
7 hosts
Sections touched
2
research, weekly-research
Co-occurring entities
0
no co-occurrence
ATT&CK techniques
1
pinned v19.1 · see below
2026-06-262 appearances2026-06-29

Hunting pivots

Tags
espionage ×2nation-state ×2north-korea-nexus ×2ai-abusechina-nexusidentityinfostealerrussia-nexus

ATT&CK techniques

1 technique observed across 1 entry — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.1 · compare on the matrix · Navigator layer (JSON)

Persistence TA0003

T1543.001Create or Modify System Process: Launch Agent×1

Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in <code>/System/Library/LaunchAgents</code>, <code>/Library/LaunchAgents</code>, and <code>~/Library/LaunchAgents</code>. Property list files use the <code>Label</code>, <code>ProgramArguments </code>, and <code>RunAtLoad</code> keys to identify the Launch Agent's name, executable location, and execution time. Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.

Evidence: 2026-06-26/macos-gaslight-a-dprk-aligned-rust-backdoor-that-targets-the · ATT&CK page ↗

Privilege Escalation TA0004

T1543.001Create or Modify System Process: Launch Agent×1

Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in <code>/System/Library/LaunchAgents</code>, <code>/Library/LaunchAgents</code>, and <code>~/Library/LaunchAgents</code>. Property list files use the <code>Label</code>, <code>ProgramArguments </code>, and <code>RunAtLoad</code> keys to identify the Launch Agent's name, executable location, and execution time. Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.

Evidence: 2026-06-26/macos-gaslight-a-dprk-aligned-rust-backdoor-that-targets-the · ATT&CK page ↗

Story timeline

  1. 2026-06-29Threat-actor developments: Russia-nexus espionage broadens; new China-nexus and DPRK clusters
    weekly-research
  2. 2026-06-26macOS.Gaslight — a DPRK-aligned Rust backdoor that targets the LLM-assisted analyst
    research

Where this entity is cited

  • research1
  • weekly-research1

Source distribution

  • cloud.google.com1 (14%)
  • ic3.gov1 (14%)
  • infosecurity-magazine.com1 (14%)
  • securelist.com1 (14%)
  • sentinelone.com1 (14%)
  • thehackernews.com1 (14%)
  • unit42.paloaltonetworks.com1 (14%)

explore in graph

All cited sources (7)

Entries about macOS.Gaslight (2)

2026-06-29 · view entry permalink →

HIGH

Threat-actor developments: Russia-nexus espionage broadens; new China-nexus and DPRK clusters

The most significant new actor finding the dailies did not carry is Turla's STOCKSTAY — Google GTIG characterised a multi-component .NET/Windows Forms backdoor that communicates C2 over secure WebSocket and shares significant code overlap with Kazuar (Turla's staple implant since 2017). Delivery used malicious RDP files by phishing and, as recently as November 2025, RAR archives exploiting WinRAR's CVE-2025-8088 (a flaw also abused by Sandworm, Gamaredon and RomCom). Current targeting is Ukrainian government and military, but earlier victims had Italian, Dutch, Polish and German foreign-policy interest — a direct read-across for Swiss federal and European governmental entities with Ukraine-adjacent policy work (The Hacker News). This sits alongside the week's other Russia-nexus signal: FBI/CISA escalated their warning that Russian intelligence (tracked as UNC5792) is now phishing Signal Backup Recovery Keys for persistent account takeover, and ESET's Gamaredon retrospective (§ 7) shows the FSB-linked group moving exfil and C2 wholesale onto trusted cloud services.

Two non-Russian clusters round out the picture. Unit 42 documented CL-STA-1062, a Chinese-speaking cluster (overlapping Talos's UAT-7237) deploying the new TinyRCT .NET backdoor via AppDomainManager injection against Southeast-Asian government and state-owned energy targets (Unit 42); Kaspersky GReAT analysed the StrikeShark cluster's SharkLoader deploying Cobalt Strike via "Perfect DLL Hijacking" against government targets (Securelist). And SentinelLABS' macOS.Gaslight, a DPRK-aligned Rust backdoor, notably turns prompt injection on the LLM-assisted analyst rather than the sandbox (SentinelLABS) — an early instance of tradecraft built specifically to poison AI-assisted triage. Attribute the claim to the research outfit, not the state, where the source itself hedges.

research29 Jun 00:21Zmulti-sourceOpen finding ↗
Sources: Google GTIG — STOCKSTAY · FBI IC3 PSA I-062626-PSA · Unit 42 — CL-STA-1062

2026-06-26 · view entry permalink →

HIGH

macOS.Gaslight — a DPRK-aligned Rust backdoor that targets the LLM-assisted analyst

SentinelLABS analysed macOS.Gaslight, a single-binary Rust implant it ties with high confidence to DPRK-aligned activity (Apple's XProtect detects it as MACOS_BONZAI_COBUCH, with a sibling sample caught by the AIRPIPE rule SentinelLABS also attributes to North Korea) (SentinelLABS, 2026-06-23). Its novel evasion is aimed at the analyst's tooling rather than a sandbox: the binary carries a 3.5 KB Markdown-fenced blob of 38 fabricated "system" messages whose {{DATA}} tokens mimic an LLM triage harness's own prompt scaffold, designed to push an LLM agent into aborting, truncating, or refusing its analysis (Infosecurity Magazine, 2026-06-24). Beyond that, it is a full stealer — staging a CPython interpreter at runtime to harvest Chrome/Brave/Firefox/Safari credentials, terminal history, system_profiler output, and a wholesale copy of login.keychain-db. C2 runs over the Telegram Bot-API getUpdates polling loop with AES-GCM payloads over certificate-pinned TLS; persistence is a LaunchAgent labelled com.apple.system.services.activity (T1543.001).

Why it matters to us: as LLM-assisted triage moves into SOC and MDR workflows, embedding adversarial prompt payloads in samples to corrupt that pipeline is a technique class to expect generalising — treat "benign" LLM verdicts on submitted macOS binaries as provisional pending human review, and flag any binary carrying large role/content message arrays for secondary analysis. Detection concepts: LaunchAgent plists masquerading under com.apple.system.services.* with non-Apple signers; processes spawning Python from non-standard parents; outbound TLS to api.telegram.org from non-user-initiated processes on managed Macs.

research26 Jun 04:54Zmulti-sourceOpen finding ↗
Sources: SentinelLABS · Infosecurity Magazine