macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox

A sophisticated Rust-based macOS implant named macOS.Gaslight has been discovered, featuring a novel 3.5 KB prompt-injection payload containing 38 fabricated system messages designed to disrupt LLM-assisted malware analysis. The backdoor communicates via Telegram Bot API with AES-GCM encrypted payloads over certificate-pinned TLS and includes self-redaction capabilities to hide its bot token from logs. It provides operators with an interactive shell, system information collection, and credential stealing capabilities through a bundled Python script that targets browser data, keychains, and command histories. The implant uses runtime-fetched CPython interpreters and establishes persistence through a LaunchAgent masquerading as an Apple system service. This threat is assessed with high confidence to be aligned with DPRK activity and represents a significant evolution in adversarial techniques targeting security analysts rather than sandbox environments.

Pulse ID: 6a3b512d529a1b06d095af2b
Pulse Link: https://otx.alienvault.com/pulse/6a3b512d529a1b06d095af2b
Pulse Author: AlienVault
Created: 2026-06-24 03:38:21

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BackDoor #Browser #CyberSecurity #DPRK #ELF #InfoSec #Mac #MacOS #Malware #OTX #OpenThreatExchange #Python #RAT #Rust #TLS #Telegram #bot #AlienVault

Xi Jinping's June 8–9 state visit to Pyongyang has triggered a Chinese-language tutoring boom across North Korea. In Sinuiju, demand for private lessons is soaring — parents want their children fluent before China trade opens up in earnest.

https://www.dailynk.com/english/north-korea-chinese-language-tutoring-surge-north-china-relations/

#NorthKorea #DPRK #ChinaDPRK #NKEconomy

#NorthKorea's National Intelligence Agency is going door to door in border cities — Hoeryong, Musan, Onsong — warning residents that Chinese mobile phone users are "cancerous tumors in the body of the nation." Agents are enlisting neighbors to surveil neighbors.

https://www.dailynk.com/english/north-korea-chinese-mobile-phone-crackdown-border/

#NorthKorea #DPRK #Surveillance #ChinaDPRK

North Korea's neighborhood watch units are ordering each household to submit 50 kg of dried human waste as fertilizer — even as state media boasts 105% industrial growth at the country's fertilizer complexes.

https://www.dailynk.com/english/north-korea-human-waste-quota-fertilizer-propaganda/

#NorthKorea #DPRK #Agriculture #FoodSecurity

📢 Attaque supply chain via astro.config.mjs avec C2 blockchain sur dépôt GitHub populaire
📝 ## 🔍 Contexte

Analyse technique publiée le 12 juin 2026 par SafeDep, documentant une attaque de type supply chain ciblant le dépôt open source *...
📖 cyberveille : https://cyberveille.ch/posts/2026-06-21-attaque-supply-chain-via-astro-config-mjs-avec-c2-blockchain-sur-depot-github-populaire/
🌐 source : https://safedep.io/astro-config-blockchain-c2-supply-chain/
#DPRK #IOC #Cyberveille

Friday, June 19, 2026

https://activitypub.writeworks.uk/2026/06/friday-june-19-2026/

Xi Jinping's visit to North Korea has Hyesan residents hoping for a turning point — Chinese capital, mineral deals, factories, tourism, anything to ease the economic squeeze.

https://www.dailynk.com/english/xi-jinpings-visit-to-north-korea-sparks-hope/

#NorthKorea #DPRK #China #ChinaDPRK