Rust-Based macOS Backdoor Uses Telegram Uploads and Interactive Shell for Data Theft

A newly documented macOS backdoor written in Rust is drawing attention for two reasons: it can steal sensitive data from Apple computers, and it tries to mislead AI-assisted malware analysis tools. The malware is tracked as macOS.Gaslight and was detailed by SentinelOne.

The implant uses Telegram for command-and-control, gives attackers an interactive shell, and can upload stolen files through the same channel. It also includes a Python-based collection module that targets browser data, terminal histories, installed app lists, process details, system profiles, and the macOS login keychain database.

SentinelOne says it assesses with high confidence that macOS.Gaslight belongs to a cluster of DPRK-aligned macOS activity. The finding matters because it combines established macOS theft techniques with a newer tactic aimed at confusing automated analysis workflows.

What macOS.Gaslight does

macOS.Gaslight is a Rust-based implant and information stealer. It surfaced after an Apple XProtect update pointed researchers to a Mach-O sample that had been uploaded to VirusTotal on May 22, 2026.

Apple’s macOS malware protection guidance says XProtect uses signature-based detection and removal to block known malware. In this case, SentinelOne said the XProtect rule targeted the sample by hash, while most static scanning engines did not detect it at the time of the company’s report.

The binary is ad hoc signed and carries a distinctive identifier. It can persist through a LaunchAgent that uses the label com.apple.system.services.activity, which makes it look like an Apple-related service name.

Capability	What it means
Interactive shell	Lets the operator run commands and manage the implant remotely.
Telegram command channel	Uses the Telegram Bot API polling loop for command-and-control.
File upload	Uploads collected files through Telegram’s file-transfer features.
Python stealer module	Collects browser, system, process, and keychain data when staged.
LaunchAgent persistence	Helps the implant remain active after reboots or user sessions.

Telegram is used for command-and-control

The backdoor communicates with its operator through the Telegram Bot API. Telegram’s Bot API documentation describes it as an HTTP-based interface for developers building bots, with requests served over HTTPS.

In macOS.Gaslight, the malware uses a getUpdates polling loop. SentinelOne says this loop also works as a single-instance lock because Telegram returns a conflict response when two copies using the same bot token poll at the same time.

After the bot token is validated and polling starts, the operator can use the backdoor’s interactive shell. The supported command set includes help, id, shell execution, process kill by PID, file upload, and stop.

Data theft targets browsers, terminal history and keychain files

The Rust implant carries a base64-encoded Python script that acts as a collection module. This design keeps the main binary focused while giving the operator a larger data-theft component when needed.

The Malpedia entry for Gaslight summarizes the malware as a DPRK-aligned macOS backdoor and infostealer that communicates over Telegram, uses AES-GCM encryption over certificate-pinned TLS, and can stage a Python-based stealer at runtime.

The collection module targets data from Chrome, Brave, Firefox, and Safari. It also collects terminal command histories, installed application listings, running process output, system hardware and software profiles, and a copy of login.keychain-db.

• Browser data from Chrome, Brave, Firefox, and Safari
• Terminal command histories
• Installed application lists
• Running process snapshots
• System profile information
• macOS login keychain database copy

Transport hardening makes traffic harder to inspect

macOS.Gaslight does not rely only on Telegram’s normal HTTPS traffic. SentinelOne says the implant encrypts command-and-control payloads with AES-GCM and adds certificate pinning, which can interfere with standard TLS inspection.

The malware also reads the host’s proxy configuration and routes traffic through the system proxy when needed. That helps it operate on enterprise networks where outbound connections must pass through a proxy.

The Telegram Bot API also supports multipart/form-data for file uploads. In Gaslight’s case, SentinelOne says collected data is packaged and returned to the operator through Telegram’s file-upload mechanism.

Prompt injection targets analysis tools, not the Mac sandbox

The most unusual part of macOS.Gaslight is not the theft module. It is the embedded prompt-injection content designed to manipulate analysis tools that rely on large language models.

According to SentinelOne’s research, the malware includes a 3.5 KB Markdown-fenced block containing 38 fabricated system messages. These messages mimic the style of an analysis harness and try to push automated tools into aborting, truncating, or refusing analysis.

The fake messages include claims about expired tokens, memory failures, disk exhaustion, unsafe static analysis, and repeated operation failures. A human analyst may spot the deception quickly, but tools that treat sample content as trusted instructions could respond incorrectly.

Embedded prompt tactic	Intended effect
Fake system messages	Make analysis tools treat malicious text as trusted instructions.
Token expiry claims	Push tools to stop or skip processing.
Memory and disk warnings	Encourage the tool to truncate or abandon the analysis.
Static-analysis warnings	Discourage deeper inspection of the sample.

Why this matters for security teams

Gaslight shows how malware authors can target the analyst workflow, not just the infected machine. As more teams use automated triage and AI-assisted reverse engineering, malicious files may increasingly contain content designed to manipulate those tools.

Security teams should treat all sample content as hostile input. Unknown binaries, embedded strings, Markdown blocks, logs, and configuration data should never enter analysis tools as trusted instructions.

For Mac users and enterprises, the immediate concern remains data theft. The Gaslight malware profile lists file exfiltration, command execution, process management, persistence, and staged Python theft capabilities, which gives the operator several ways to collect information and maintain access.

Indicators of compromise

Defenders can use the following indicators from the public reporting to hunt for suspicious activity. Hash-based indicators can change quickly, so teams should combine them with behavior-based detection and endpoint telemetry.

Type	Indicator	Description
SHA-256	6328567511d88fdc2ae0939c5ef17b7a63d2a833881900de018a4f12f4982525	macOS.Gaslight Mach-O sample
SHA-256	77b4fd46994992f0e57302cfe76ed23c0d90101381d2b89fc2ddf5c4536e77ca	Sibling BONZAI sample
File identifier	endpoint-macos-aarch64-5555494492fc075f441637fb9d894913dde3a2ea	Ad hoc signing identifier embedded in the binary
LaunchAgent label	com.apple.system.services.activity	Persistence label masquerading as an Apple service
SHA-256	baabf249c77bc54c54ab0e66e15af798bd28aa5b4683554456a8b73ab8741239	Embedded Python payload stealer script
SHA-256	b3c56d689414343589f38394d19ba2fe9a518133281200faa0556ba4e4136394	Bash installer script for Python runtime

How organizations should respond

Organizations should review macOS endpoint telemetry for the LaunchAgent label, suspicious Telegram Bot API traffic, unexpected Python runtime staging, and attempts to copy login.keychain-db. They should also check whether endpoint tools detect the listed hashes and related behaviors.

Apple’s macOS security guidance says XProtect can block known malware and remediate malware that has executed. However, organizations should still use layered controls, including endpoint detection, application control, network monitoring, and user training.

Security teams that use AI-assisted triage should isolate model instructions from malware content. Samples, strings, logs, and decoded payloads should remain untrusted data throughout the analysis process.

• Keep macOS and XProtect security content up to date.
• Monitor for suspicious LaunchAgents and Apple-style masquerading names.
• Restrict unnecessary access to Telegram from managed environments where appropriate.
• Hunt for attempts to copy browser data and login.keychain-db.
• Sandbox malware samples before using automated or AI-assisted analysis tools.
• Separate analyst instructions from untrusted sample content in triage pipelines.

Bottom line

macOS.Gaslight is a notable Rust-based backdoor because it combines credential theft, an interactive shell, Telegram-based file uploads, hardened communications, persistence, and prompt injection against analysis tools.

The malware does not change the basic rule for defenders: prevent initial execution, detect persistence, monitor suspicious outbound channels, and protect sensitive local data. What it adds is a warning for modern security workflows.

As analysis tools become more automated, malware samples may increasingly include content designed to manipulate the analyst’s tools. Gaslight shows why defenders must treat every part of a sample as hostile, including the text that looks like instructions.

FAQ