DPRK-Linked macOS Implant Uses LaunchAgent Persistence and Python Stealer Module

The binary tracked as macOS.Gaslight as a Rust-based macOS implant and infostealer whose most novel features are analyst-directed prompt injection and a hardened Telegram-based command-and-control (C2) channel.

We assess with high confidence that macOS.Gaslight aligns with DPRK-linked macOS activity clustered around BONZAI and AIRPIPE signatures.

macOS.Gaslight is ad hoc signed, carries the identifier endpoint-macos-aarch64-5555494492fc075f441637fb9d894913dde3a2ea, and implements its primary logic in Rust.

In early June, Apple’s XProtect flagged a Mach-O sample uploaded to VirusTotal on May 22 that static engines initially missed.

Its network channel uses Telegram Bot API polling (getUpdates) with operators controlling the implant through an interactive shell. The implant validates a bot token and uses Telegram multipart attach:// uploads for exfiltration.

To limit forensic exposure, the binary self-redacts the bot token in runtime output: when the URL path segment equals the literal “file” it replaces the token with a hardcoded placeholder, preventing token recovery from logs or crash artifacts.

Transport hardening combines AES-GCM payload encryption and strict certificate pinning. C2 messages are encrypted with aes-gcm (Rust crate) using per-message nonces created with CCRandomGenerateBytes; the AES key is provided at runtime via configuration.

The implant also sets a custom trust anchor via SecTrustSetAnchorCertificatesOnly so TLS validation is limited to the operator’s certificate, thwarting proxy-CA interception.

According to SentinelLABS, a Rust macOS implant that embeds a 3.5 KB prompt-injection payload of 38 fabricated “system” messages, built to steer an LLM-assisted triage pipeline.

Persistence exploits a LaunchAgent masquerade. The sample writes a plist labeled com.apple.system.services.activity and resolves its executable path at runtime via __NSGetExecutablePath to populate ProgramArguments.

DPRK-Linked macOS Implant

Persist_enable and persist_name_macos appear in a baked-in serde configuration schema of 15 fields, hinting at a cross-platform operator interface; several Linux and GitHub fields are unused in this build.

Simultaneously, it reads system proxy settings (SCDynamicStoreCopyProxies) and routes reqwest/hyper requests accordingly, enabling operation on networks that enforce outbound proxies while still obstructing inspection.

Collection is gated behind a runtime-steered Python module and installer. The Rust implant contains a 6.6 KB base64-encoded Python stealer that harvests browser data (Chrome, Brave, Firefox, Safari), terminal histories, installed apps, running-process snapshots, system_profiler output, and a raw copy of login.keychain-db. Collected artifacts are archived and uploaded over Telegram.

A separate ~2 KB base64-encoded bash installer stages a standalone cpython-3.10.18 interpreter from astral-sh/python-build-standalone, enabling stealer execution without bundling a full Python runtime inside the Rust binary.

The installer bears attributes consistent with LLM-generated output (emojis, strict comment headers), an operational separation that preserves a small Rust implant while deploying richer Python tooling on demand.

Operator access includes an interactive shell exposing commands to run shell commands, identify the implant, upload files, kill processes, and stop the implant.

The implant prevents system sleep by creating an IOPMAssertionCreateWithName assertion, ensuring long-running C2 polling and collection.

Masquerading within Apple’s com.apple.* namespace is a tactic widely used in many macOS malware families, including those previously tied to DPRK-linked activities.

Most striking is the embedded 3.5 KB prompt-injection payload: 38 fabricated “system” messages wrapped in {{DATA}} markers and Markdown fences that mimic the prompt scaffolding used by LLM-assisted triage systems.

Rather than attacking the sandbox, this payload targets analyst tooling and model-driven workflows seeding fake errors, token-expiry warnings, and false static-analysis flags designed to cause an LLM agent to abort, refuse, or misprioritize analysis.

This adversarial technique builds on earlier public reporting of prompt-injection evasions but is novel in its multi-message cascade and explicit targeting of analyst-facing LLM pipelines.

macOS.Gaslight consolidates established macOS tradecraft LaunchAgent persistence, credential theft, interactive C2 with robust operational hygiene and a deliberate effort to manipulate automated analysis.

Indicators of Compromise

macOS.Gaslight Mach-O sample	6328567511d88fdc2ae0939c5ef17b7a63d2a833881900de018a4f12f4982525
Sibling BONZAI sample	77b4fd46994992f0e57302cfe76ed23c0d90101381d2b89fc2ddf5c4536e77ca
Ad hoc signing identifier	endpoint-macos-aarch64-5555494492fc075f441637fb9d894913dde3a2ea
LaunchAgent Label	com.apple.system.services.activity
Python payload script	baabf249c77bc54c54ab0e66e15af798bd28aa5b4683554456a8b73ab8741239
Bash Installer script	b3c56d689414343589f38394d19ba2fe9a518133281200faa0556ba4e4136394

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.