Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox
Excerpt
Executive Summary SentinelLABS has analyzed a Rust macOS implant that embeds a 3.5 KB prompt-injection payload of 38 fabricated “system” messages, built to steer an LLM-assisted triage pipeline into aborting or refusing its analysis. Command-and-control runs over a Telegram Bot API polling loop, with AES-GCM payloads over certificate-pinned TLS. The implant self-redacts its Telegram bot token in its own runtime output, denying it to anyone who captures logs or crash…
Read the original report →Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | e4503e31d5a297d93ade64f50a5b5fe91e73dad251ac2615b4c975684f68e080 | Medium | Score 53/100 | First seen |
| SHA1 | 5555494492fc075f441637fb9d894913dde3a2ea | Medium | Score 53/100 | First seen |
| SHA256 | baabf249c77bc54c54ab0e66e15af798bd28aa5b4683554456a8b73ab8741239 | Medium | Score 40/100 | First seen |
| SHA256 | 77b4fd46994992f0e57302cfe76ed23c0d90101381d2b89fc2ddf5c4536e77ca | Medium | Score 55/100 | First seen |
| SHA256 | 6328567511d88fdc2ae0939c5ef17b7a63d2a833881900de018a4f12f4982525 | Medium | Score 55/100 | First seen |
IOC Relationship Graph
Building graph…