macOS.Gaslight is a Rust macOS backdoor tied to DPRK-aligned activity, using Telegram C2, AES-GCM, and TLS pinning. It also packs a Python stealer and prompt injection to confuse LLM-based triage. #macOSGaslight #DPRK #AppleXProtect
macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox
SentinelLABS analyzed macOS.Gaslight, a Rust macOS implant tied to DPRK-aligned activity that combines Telegram-based command and control, AES-GCM encryption, certificate-pinned TLS, and a bundled Python stealer. The sample also includes a 3.5 KB prompt-injection payload with 38 fabricated system messages designed to derail LLM-assisted triage and hide its malicious behavior. #macOSGaslight #BONZAI #AIRPIPE #Telegram #AppleXProtect
www.hendryadrian.com
June 24, 2026 at 12:15 PM
macOS.Gaslight is a Rust macOS backdoor tied to DPRK-aligned activity, using Telegram C2, AES-GCM, and TLS pinning. It also packs a Python stealer and prompt injection to confuse LLM-based triage. #macOSGaslight #DPRK #AppleXProtect
New Banshee Stealer Variant Bypasses Antivirus with Apple’s XProtect-Inspired Encryption reconbee.com/new-banshee-...
#Bansheestealer #Bypass #antivirus #applexprotect #antivirus #cyberattack #malwareattack #malware
#Bansheestealer #Bypass #antivirus #applexprotect #antivirus #cyberattack #malwareattack #malware
New Banshee Stealer Variant Bypasses Antivirus with Apple's XProtect-Inspired Encryption
firm in late September 2024 read more about New Banshee Stealer Variant Bypasses Antivirus with Apple's XProtect-Inspired Encryption
reconbee.com
January 10, 2025 at 3:28 PM
New Banshee Stealer Variant Bypasses Antivirus with Apple’s XProtect-Inspired Encryption reconbee.com/new-banshee-...
#Bansheestealer #Bypass #antivirus #applexprotect #antivirus #cyberattack #malwareattack #malware
#Bansheestealer #Bypass #antivirus #applexprotect #antivirus #cyberattack #malwareattack #malware