Executive Summary
SentinelLABS has identified a new Rust-based macOS implant, tracked as macOS.Gaslight, attributed with high confidence to DPRK-aligned threat activity. The malware is notable for its use of 38 fabricated 'system' messages designed as a prompt-injection payload to manipulate and thwart automated LLM-assisted triage engines by mimicking analysis failures and token expiry warnings.
Technically, the implant utilizes the Telegram Bot API for command-and-control (C2), featuring custom certificate pinning and AES-GCM encryption for transport hardening. It includes an interactive shell, a persistent LaunchAgent masquerading as an Apple system service, and a modular Python-based stealer that harvests sensitive data including browser history and the macOS login keychain. The malware also features novel OPSEC measures such as self-redacting its Telegram bot token from runtime logs.
This campaign highlights the evolution of adversary tradecraft as threat actors begin to target the automated analysis tools used by SOC teams. The focus on stealing credentials and session data, combined with persistence, poses a significant risk to affected organizations.