macOS.Gaslight Python Stealer Harvesting login.keychain-db

Ethan Andrews@eandrews

•updated Jun 24, 2026•2•0•7

Detects the macOS.Gaslight Python-based secondary collection module copying login.keychain-db from ~/Library/Keychains/ to a staging directory and compressing collected data into temp/collected_data.zip for exfiltration. This activity is associated with DPRK-aligned Contagious Interview / PhantomCaptcha campaigns.