macOS.Gaslight Rust backdoor execution - hash match or Python subprocess spawn

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•4

Detects macOS.Gaslight malware activity through two branches: direct hash matches of known binaries and the spawning of Python subprocesses with specific command-line arguments indicative of data collection or archiving. The Python subprocess detection looks for Python scripts being executed from '/tmp/' or '/Library/' directories with arguments related to browser data collection, keychain access, or archiving operations.