macOS Gaslight backdoor runtime API resolution via dlsym/dlopen

Duo Tech@duotech

•updated Jul 2, 2026•0•0•1

Detects macOS binaries that employ dynamic API resolution by using 'dlsym' and 'dlopen' to resolve sensitive functions like 'SecTrustSetAnchorCertificatesOnly' or 'IOPMAssertionCreateWithName' at runtime. This technique is often used to avoid static analysis by bypassing import table monitoring and string extraction.