DPRK-Linked macOS Implant Uses LaunchAgent Persistence and Python Stealer Module

macOS.Gaslight is a Rust-implemented macOS implant and infostealer attributed to DPRK-linked operators (BONZAI/AIRPIPE). The sample uses a hardened Telegram Bot API C2 with per-message AES-GCM encryption and certificate pinning, self-redacts credentials at runtime, persists via a LaunchAgent, and deploys a base64-encoded Python stealer and bash installer to harvest browsers, terminal histories, and login.keychain-db. Notably, it contains a 3.5 KB prompt-injection payload designed to manipulate LLM-assisted analyst tooling; the report includes multiple IOCs (file hashes, signing identifier, LaunchAgent label) for detection and response.