A newly identified macOS backdoor, tracked as macOS.Gaslight, employs a sophisticated technique to evade security analysis by embedding fabricated system messages designed to mislead AI-powered security tools. Researchers have assessed with high confidence that this implant is linked to North Korean state-aligned threat activity.
The implant, written in Rust, was first observed when an Apple XProtect update in early June flagged a Mach-O sample uploaded to VirusTotal in May. While XProtect's detection is based on the file's hash, many static analysis engines have yet to identify it. The sample is signed with an ad hoc certificate and carries the identifier endpoint-macos-aarch64-5555494492fc075f441637fb9d894913dde3a2de2a.
The core innovation of macOS.Gaslight lies in its embedded payload of approximately 3.5 KB containing 38 fake "system" messages. These messages are crafted to appear as legitimate system failures or errors, intended to confuse and disrupt Large Language Model (LLM) assisted security analysis pipelines. Instead of directly attacking the sandbox environment, the malware targets the analytical process itself, aiming to cause the AI to abort or refuse its analysis.
Command and control (C2) communications are managed through a Telegram Bot API, utilizing a polling loop. The implant encrypts its payloads using AES-GCM, implemented with the aes-gcm 0.10.3 Rust crate, and generates a new nonce for each message. The AES key is provided at runtime rather than being embedded in the binary.
Further hardening its C2 channel, the implant employs certificate pinning by configuring a custom trust anchor and restricting TLS trust evaluation solely to that anchor. This measure prevents network-level inspection by standard proxy Certificate Authorities (CAs). Despite this, the implant respects the host's proxy settings, routing traffic through system-configured proxies to ensure connectivity even on networks that enforce outbound proxy usage.
Upon successful validation, the operator gains access to an interactive shell. This shell provides six defined verbs: "help" for command assistance, "id" to identify the implant, "exec" to execute shell commands, "kill" to terminate processes by PID, "upload" for file exfiltration via Telegram, and "stop" to halt the implant. Evidence suggests a seventh command, "focus," may also exist, though its functionality could not be fully recovered.
To maintain persistence, the implant creates a power management assertion to prevent the system from sleeping, ensuring continuous C2 polling and data collection even during periods of user inactivity.
The implant's configuration, including the Telegram bot token, chat ID, and AES key, is supplied at runtime and is not present in the analyzed sample. This configuration is managed through a 15-field schema read by the `serde` Rust serialization framework, with field names baked into the binary as plaintext. Some fields, such as those related to Linux and GitHub, are not utilized in the current sample, suggesting the schema supports a broader toolset.
A data collection module, embedded as a base64-encoded Python script, harvests sensitive information. This includes browser data from Chrome, Brave, Firefox, and Safari, terminal command histories, lists of installed applications, running processes, system hardware and software profiles, and a copy of the `login.keychain-db` file. Collected artifacts are archived and uploaded via Telegram.
Interestingly, the Python stealer requires a specific runtime environment. A separate bash installer script fetches and stages a self-contained CPython 3.10.18 interpreter from the astral-sh/python-build-standalone project. This installer, which includes build metadata like `PY_VERSION=3.10.18` and `BUILD_DATE=20250708`, targets both arm64 and x86_64 macOS architectures. The use of emojis and comment headers in the bash script suggests it may have been generated with AI assistance. This modular approach allows the main implant to remain in Rust while enabling the deployment of a more comprehensive Python-based collection environment when needed.
The macOS.Gaslight implant's association with North Korean activity is further supported by Apple's XProtect rule `MACOS_BONZAI_COBUCH`, which SentinelLabs links to North Korean threat actor activity. Another related BONZAI sample is also detected by Apple's `AIRPIPE` rule, a family also attributed to North Korean operations by SentinelLabs.
