macOS.Gaslight Python Stealer ZIP Archive Staging via shutil.make_archive

Ethan Andrews@eandrews

•updated Jun 24, 2026•0•0•3

Detects the macOS.Gaslight Python collection module compressing staged data into a ZIP archive (collected_data.zip) using shutil.make_archive for subsequent exfiltration over Telegram C2. The module calls compress_output() which archives browser credentials, keychain, terminal history, and process snapshots into temp/collected_data.zip.