macOS.Gaslight dlsym Runtime API Resolution in aarch64 Mach-O Binary

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•4

Detects execution of the macOS.Gaslight Rust-based implant. The rule identifies the specific malicious binary by its SHA-256 hash and targets its behavior of using runtime dynamic symbol resolution (via dlsym) to hide API calls from static analysis.