macOS.Gaslight Python Stealer: System Info, Process, App & History Collection

Ethan Andrews@eandrews

•updated Jun 24, 2026•1•0•4

Detects the macOS.Gaslight embedded Python collection module executing sequential reconnaissance functions: collect_system_info(), collect_running_processes(), collect_applications(), and collect_terminal_history() via ps aux and system_profiler, consistent with DPRK-aligned macOS.Gaslight stealer activity.