macOS.Gaslight Malware Removal and Account Recovery

macOS.Gaslight is a Rust backdoor and information stealer, not a legitimate Apple system service. If XProtect reports MACOS_BONZAI_COBUCH, or you find the exact LaunchAgent label com.apple.system.services.activity pointing to an unfamiliar executable, disconnect the Mac from the network and preserve the evidence before removing it. Do not change passwords on that Mac. Use a separate trusted device because the analyzed implant can collect browser data, terminal history, and a copy of the login Keychain database.

The family name, label, or hash can support a diagnosis, but each clue has limits. The researchers did not identify the analyzed sample’s initial delivery method, and a com.apple.* name alone does not prove that every matching file is malicious. Verify the plist’s target, the target’s signature, and its SHA-256 before deleting anything.

What Is macOS.Gaslight?

SentinelLABS described macOS.Gaslight in June 2026 after an Apple XProtect update surfaced a Mach-O sample. The sample is an ad hoc-signed Rust implant that communicates through a Telegram Bot API polling loop, encrypts command traffic with AES-GCM over pinned TLS, and gives an operator an interactive shell. It can run commands, stop processes, upload files, and prevent the Mac from sleeping while the connection remains active. ^[1]

A configurable Python collection module can gather Chrome, Brave, Firefox, and Safari data; terminal command histories; installed-app and running-process lists; a system profile; and a raw copy of login.keychain-db. The collection is archived and can be sent to the operator. The sample also contains a separate installer capable of staging a standalone Python runtime, but the researchers could not recover every runtime branch. Treat these as documented capabilities in the sample, not proof that every Gaslight infection used every module.

The same boundary applies to attribution. SentinelOne assessed the implant as part of a DPRK-aligned macOS activity cluster, but a home user should make the cleanup decision from local evidence—not from a geopolitical label.

Which Evidence Matters?

Contain the Mac Before Removing Files

1. Disconnect Wi-Fi, Ethernet, and VPN access. Gaslight can provide an interactive shell and upload files. On a managed Mac, contact the security or IT team before changing artifacts.
2. Do not sign in to important accounts. A still-running stealer could capture new sessions or credentials. Use a separate trusted phone or computer for recovery.
3. Record what triggered the investigation. Save the XProtect rule, detected path, alert time, plist path, executable path, code-signing output, and hash. Do not upload a work sample or private file to a public scanner without authorization.
4. Do not delete by label alone. An attacker deliberately chose an Apple-looking namespace. The correct decision comes from the plist target and the target’s properties.

If the Mac only received an XProtect alert and Apple moved the file to Trash before it ran, the response may be limited to updating macOS, emptying Trash after evidence is recorded, restarting, and checking for persistence. If the LaunchAgent, matching binary, unexplained network activity, or other execution evidence is present, treat the Mac as compromised.

Verify the LaunchAgent and Its Target

Start with a read-only search for the exact label in the user and system LaunchAgent folders:

grep -RIl "com.apple.system.services.activity" \
  "$HOME/Library/LaunchAgents" /Library/LaunchAgents 2>/dev/null

If the search returns a plist, inspect it instead of assuming the filename matches the label:

plutil -p "/exact/path/to/suspicious.plist"

Copy the absolute executable path from ProgramArguments. Then inspect its signature and calculate its hash:

codesign -dv --verbose=4 "/exact/path/to/suspicious-binary"
shasum -a 256 "/exact/path/to/suspicious-binary"

A strong match combines the exact label with an unfamiliar target, the documented ad hoc signing identifier or hash, an XProtect alert, or behavior consistent with the backdoor. If the target belongs to a known application and the hash does not match, stop and have the file reviewed rather than forcing the Gaslight diagnosis.

How to Remove Confirmed Gaslight Persistence

1. Preserve the plist and target details. On a work Mac, let the incident-response team collect them. For a personal Mac, keep screenshots and hashes before cleanup.
2. Unload the confirmed user LaunchAgent. Replace the example path only with the plist you verified:

launchctl bootout "gui/$(id -u)" "/exact/path/to/suspicious.plist"

3. Move the confirmed malicious plist and executable to Trash. Do not reuse a downloaded installer or restore the same files from backup. Empty Trash only after you no longer need the evidence.
4. Update macOS and security data. XProtect signatures update independently, and Apple uses XProtect to block and remediate known malware. Restart the Mac after updates; XProtect’s remediation process does not restart it automatically. ^[2]
5. Check again after restart. Repeat the exact-label search, confirm the target no longer exists, review System Settings → General → Login Items & Extensions, and watch for another XProtect alert or unexpected network activity.

Do not combine artifact lists from unrelated families. CrashStealer, ClickLock Stealer, FlutterShell, and Odyssey Stealer are separate Mac threats with different delivery and persistence evidence.

When a Clean Erase and Reinstall Is Safer

Manual removal can be reasonable when XProtect blocked the known file before execution and no persistence or follow-on activity exists. A clean erase and reinstall is safer when the matching LaunchAgent and binary ran, an interactive shell may have been active, the operator could have changed unknown files, the alert returns after cleanup, or you cannot identify every executable referenced by the persistence item.

Back up personal documents, not unknown applications, scripts, LaunchAgents, browser profiles, shell startup files, or the whole Library folder. Reinstall applications from their official sources. On a managed Mac, follow the organization’s reimage and credential-rotation process rather than improvising a personal cleanup.

Recover Accounts and Secrets From a Clean Device

Gaslight’s collection scope makes deletion only the first half of recovery. The raw Keychain copy does not prove every stored secret was decrypted, but it is sensitive enough to treat the exposed Mac as untrusted.

1. Secure the primary email account first. Change its password, sign out other sessions, review forwarding rules and recovery methods, and confirm multi-factor authentication.
2. Secure the Apple Account. Change the password, remove unknown trusted devices, verify account details, and review services signed in with that account. Apple recommends using account recovery if the password can no longer be reset normally. ^[3]
3. Revoke browser sessions. Sign out other sessions for important work, financial, social, cloud, and shopping accounts. A password change does not always invalidate an already stolen cookie.
4. Review Keychain-backed and password-manager credentials. Rotate the highest-value credentials first, especially email, work SSO, cloud consoles, and remote-access accounts.
5. Audit terminal history exposure. Rotate API keys, GitHub or GitLab tokens, cloud credentials, SSH keys, database passwords, and other secrets that may have appeared in commands or environment setup.
6. Review files that were accessible. Because the operator had an upload command, assume a specifically accessed sensitive file may have left the Mac. Scope that decision from logs and business context rather than declaring every document stolen.

For a broader recovery order, use the account takeover checklist after the Mac is isolated.

What Does the Prompt-Injection Feature Change?

The implant contains 38 fabricated “system” messages designed to confuse an LLM-assisted malware-analysis pipeline. This is an analyst-evasion experiment embedded in hostile sample data. It does not mean Gaslight can take over a consumer AI account, and it does not replace the backdoor’s conventional risks: command execution, persistence, data collection, and file upload.

For defenders, the lesson is to treat strings extracted from malware as untrusted data rather than instructions. For an affected Mac user, the practical response remains isolation, evidence verification, cleanup or reinstallation, and clean-device account recovery.

FAQ

References

1. Stokes, Phil. “macOS.Gaslight: Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox.” SentinelLABS, June 23, 2026; accessed July 30, 2026. sentinelone.com.
2. Apple. “Protecting Against Malware in macOS.” Apple Platform Security, accessed July 30, 2026. support.apple.com.
3. Apple. “If You Think Your Apple Account Has Been Compromised.” Apple Support, updated December 16, 2025; accessed July 30, 2026. support.apple.com.