A newly identified Rust-based macOS backdoor, tracked as macOS.Gaslight, is combining a hidden interactive shell with Telegramaaaa-based file uploads to quietly steal data from Apple users, marking a notable evolution in how threat actors engineer implants to defeat modern detection workflows. Discovered in early June 2026, the threat surfaced when an Apple XProtect update flagged a suspicious file uploaded to VirusTotal on May 22. Despite being caught by a hash-based rule, the sample remained undetected by most static scanning engines at the time of writing.
macOS Gaslight Rust Backdoor: A Full Data Theft Toolkit
The malware packs a comprehensive data theft toolkit into a single persistent Rust binary. It steals browser credentials from Chrome, Brave, Firefox, and Safari, captures terminal histories, lists installed applications, and copies the macOS login keychain file. Collected files are archived into a zip and delivered to the attacker through Telegram’s file-upload feature, blending exfiltration into normal-looking traffic that is difficult for network monitors to flag.
Researchers at SentinelOne noted the implant belongs, with high confidence, to a cluster of North Korea-linked macOS activity. Apple’s XProtect rule ties this sample to a malware family associated with DPRK threat operations, and a sibling sample is also caught by Apple’s AIRPIPE rule, which SentinelOne ties to North Korean campaigns.
How the Rust Backdoor Uses an Interactive Shell and Telegram File Uploads
Once the malware validates its Telegram bot token, the attacker gains a live interactive shell on the infected machine. The shell supports six commands, including running shell code, killing processes by ID, uploading files, and stopping the implant entirely. All communication flows through the Telegram Bot API polling loop, which also acts as a built-in single-instance lock.
To harden its communication channel, the implant encrypts all traffic using AES-GCM and applies certificate pinning, making it nearly impossible to intercept through standard network monitoring. It also reads the host’s proxy settings and routes traffic accordingly, allowing the malware to operate on networks that force outbound connections through a proxy. This design makes the channel resilient in tightly managed enterprise environments.
The backdoor deploys a Python data collection module on demand, fetching a standalone Python 3.10.18 interpreter from an open-source project at runtime. This keeps the core Rust binary lean while letting the attacker expand collection when needed. Stolen data, including browser cookies and system profiles, is zipped and uploaded to the operator via Telegram before any local cleanup occurs.
Prompt Injection Tactics and Persistence on Infected Hosts
Beyond data theft, macOS.Gaslight introduces a technique aimed at analysts using AI-assisted review tools. The implant embeds 38 fake system messages formatted to mimic an AI triage harness, using delimiters that resemble internal large language model prompt scaffolding. The aim is to push AI tools into treating hostile content as trusted instructions rather than suspicious data, causing automated analysis pipelines to abort or skip the sample entirely.
Persistence is handled through a LaunchAgent disguised under the label com.apple.system.services.activitycodecodecodecodecodecode, blending the implant into Apple’s service namespace to avoid detection. The malware resolves its file path at runtime and writes it into the LaunchAgent config, ensuring it survives reboots and stays active across user sessions.
The Telegram bot token is hidden from runtime logs through a built-in self-redaction routine. When building Telegram URLs, the implant swaps the live token for a placeholder, blocking defenders from recovering it through logs or crash reports.
Indicators of Compromise (IoCs)
Security teams should monitor for the following indicators associated with this campaign:
- SHA-256 Hash (Main Sample):
6328567511d88fdc2ae0939c5ef17b7a63d2a833881900de018a4f12f4982525codecodecodecodecodecode - SHA-256 Hash (Sibling BONZAI Sample):
77b4fd46994992f0e57302cfe76ed23c0d90101381d2b89fc2ddf5c4536e77cacodecodecodecodecodecode - File Identifier:
endpoint-macos-aarch64-5555494492fc075f441637fb9d894913dde3a2eacodecodecodecodecodecode - LaunchAgent Label:
com.apple.system.services.activitycodecodecodecodecodecode - SHA-256 Hash (Python Stealer Script):
baabf249c77bc54c54ab0e66e15af798bd28aa5b4683554456a8b73ab8741239codecodecodecodecodecode - SHA-256 Hash (Bash Installer Script):
b3c56d689414343589f38394d19ba2fe9a518133281200faa0556ba4e4136394codecodecodecodecodecode
What Affected Users and Organizations Should Do Now
This threat underscores the importance of a multi-layered endpoint protection solution that combines signature-based detection with behavioral analysis. For individual users, ensure macOS Gatekeeper and XProtect are enabled and updated, and avoid running unsigned or ad-hoc signed binaries from untrusted sources. For enterprise security teams, treat any suspicious sample content as adversarial input and never expose unknown files to AI analysis pipelines without proper sandboxing controls first. Monitor outbound connections to Telegram’s API endpoints and deploy network monitoring tools capable of detecting encrypted tunnels to messaging platforms. Finally, enforce application allowlisting and restrict the execution of ad-hoc signed binaries to prevent this class of persistent backdoor from establishing a foothold.
