Loading story…
SentinelLABS reported a Rust-based macOS backdoor and infostealer dubbed macOS.Gaslight that uses the Telegram Bot API for command-and-control, protected by AES-GCM encryption and certificate-pinned TLS. The implant supports an interactive shell, establishes persistence through a LaunchAgent, and deploys a configurable Python collection module to steal browser data, terminal histories, process listings, system profiles, and a copy of login.keychain-db. Researchers said the malware also redacts its Telegram bot token from runtime output, making credential recovery from logs and crash artifacts more difficult.
The researchers linked the implant with high confidence to a DPRK-aligned macOS activity cluster and said it overlaps with Apple XProtect detections in the BONZAI family, with related ties to AIRPIPE. A notable feature is an embedded 3.5 KB prompt-injection payload containing 38 fabricated system messages designed to manipulate LLM-assisted malware triage workflows into refusing or aborting analysis, marking the sample as a case of malware directly targeting AI-enabled defensive processes as well as traditional endpoint analysis.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
A GitHub security advisory disclosed a high-severity permission-gate bypass in the rtk project's `rewrite` decision path when used as the Claude Code PreToolUse hook. The issue allowed commands beginning with an allowed prefix such as `git` to conceal unauthorized shell commands via separators like newlines, `&`, `$()`, and backticks, potentially leading to arbitrary hidden command execution.
SentinelLABS published analysis of a Rust-based macOS implant and infostealer dubbed macOS.Gaslight, describing Telegram Bot API polling for C2, AES-GCM encryption, certificate-pinned TLS, LaunchAgent persistence, and data theft capabilities. The report also assessed with high confidence that the implant belongs to a DPRK-aligned macOS activity cluster and highlighted an embedded prompt-injection payload aimed at disrupting LLM-assisted malware analysis.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 66 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
13 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcesecurityaffairs.com
Open sourcexakep.ru
Open sourcecybersecuritynews.com
Open sourcegithub.com
Open sourceblog.nviso.eu
Open sourcesentinelone.com
Open sourcedocs.rs
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A targeted social-engineering campaign tracked as **REF6598** impersonated a venture-capital firm on LinkedIn and Telegram to target financial and cryptocurrency-sector personnel. Victims were persuaded to synchronize Obsidian community plugins, allowing the attackers to abuse the legitimate Shell Commands and Hider plugins—not an Obsidian vulnerability—to launch a cross-platform payload chain. Windows victims received the in-memory **PHANTOMPULL** loader and the previously undocumented **PHANTOMPULSE** remote-access trojan, while macOS victims received an obfuscated AppleScript dropper, LaunchAgent persistence, and a Telegram dead-drop fallback for command-and-control (C2) resolution. PHANTOMPULSE uses direct syscalls, hardware-breakpoint evasion of AMSI, WLDP, and ETW, process injection, scheduled-task persistence, and a public UAC-bypass technique. It can collect system and wallet data, capture screenshots and keystrokes, execute or inject payloads, and manipulate privileges; its C2 resolver retrieves encoded transaction-input data from Ethereum, Base, and Optimism Blockscout services. The resolver does not authenticate transaction senders, allowing defenders or third parties to potentially sinkhole or hijack it. The activity’s crypto-focused victimology and tradecraft align with North Korea-linked operations that have also used fake developer recruitment projects to deploy macOS RustDoor and Koi Stealer malware for theft of browser, Keychain, SSH, VPN, messaging, and cryptocurrency-wallet data.
Sep 9, 2026
**Atomic macOS Stealer (AMOS)** has emerged as a leading macOS infostealer sold as a malware-as-a-service offering on Telegram and used in campaigns that rely heavily on social engineering rather than exploits. Researchers found the Golang-based malware distributed in forms including malicious DMG installers and ClickFix-style lures that trick users into running Terminal commands, after which it captures or validates the victim’s macOS password, steals **Keychain** contents, browser credentials, cookies, autofill data, files, Apple Notes, extension storage, session tokens, system information, and cryptocurrency wallet data, then exfiltrates the results to attacker-controlled infrastructure and, in earlier observed versions, Telegram. Operators have advertised AMOS for **$1,000 per month** alongside add-on services such as a victim panel, crypto tooling, and installer support. Sophos said AMOS accounted for nearly **40%** of its macOS protection updates in 2025 and almost half of recent macOS stealer cases seen by customers, underscoring its scale and persistence. In one investigated intrusion, a bootstrap script fetched from `sphereou[.]com` downloaded a second-stage payload, performed anti-analysis checks, registered with command-and-control, and established persistence through a **LaunchDaemon** after obtaining elevated access. Earlier reporting tied AMOS infrastructure to `amos-malware[.]ru`, with exfiltration observed to `/sendlog`, while newer variants increasingly use AI-themed lures, fake installers, cracked apps, repeated password prompts, and fake Ledger and Trezor modules to broaden credential theft and cryptocurrency targeting.
Jun 29, 2026
Researchers reported multiple social-engineering campaigns targeting macOS users with **fake CAPTCHA** and **ClickFix** lures that trick victims into copying and pasting malicious commands into Terminal, shifting execution to the user and bypassing traditional app-download protections. One campaign delivered **Atomic macOS Stealer (AMOS)** through trojanized cracked applications and malicious Terminal instructions, stealing credentials, browser data, cryptocurrency wallets, Telegram data, VPN profiles, keychain contents, Apple Notes, and files from common user folders before compressing and exfiltrating them over HTTP/HTTPS. Trend Micro separately documented multistage fake CAPTCHA attacks that also led to infostealers and remote-access trojans, underscoring the broader use of human-verification themes to launch malware chains. A separate July 2026 macOS campaign used a fake **TrustKey** verification page on Cloudflare Pages, a Cloudflare Worker, and an AppleScript-based loader to install a persistent backdoor named **`bmodule`** via LaunchAgent persistence. The malware dynamically resolved live command-and-control infrastructure from a **Polygon** smart contract using an **EtherHiding** technique, then fingerprinted hosts, phished macOS login passwords, and fetched tasks to deploy AMOS variants, an interactive shell, or an **XMRig** cryptominer. Apple said **macOS Sequoia** has updated runtime protections, while incident reporting shows Terminal-based social-engineering chains remain effective because they rely on users to execute the malicious commands directly.
Aug 28, 2026