Jade Sleet used fake job lures to plant macOS backdoors

Two macOS backdoors have been linked by the security company SentinelOne to the compromise of a much smaller, India-based organization in the information technology services industry, in a campaign that reached developers through fake job interview projects. SentinelOne, which published details of the activity, identified the two programs as FLATROOF, also known as Gaslight, and ROOFDECK. Both are backdoors, meaning hidden programs that give an attacker remote control of a machine without the owner noticing. The company attributed the intrusion to the threat actor it calls Jade Sleet, and it said both tools had previously been observed in the attack on KelpDAO's LayerZero bridge between March and April 2026.

Jade Sleet is tracked under several other names, among them PUKCHONG, Slow Pisces, TraderTraitor and UNC4899, and has a history of going after the Web3 sector, the cryptocurrency and blockchain world, to carry out cryptocurrency heists. In early 2025 the group was tied to the theft of about 1.5 billion US dollars from Bybit's cold wallet infrastructure, after a supply chain compromise of Safe{Wallet}'s developer environment. A supply chain compromise means the attackers do not break into the final target directly; they tamper with software or tools that the target already trusts. GitHub, which is owned by Microsoft, noted in July 2023 that Jade Sleet mostly targets users associated with cryptocurrency and other blockchain-related organizations, but also targets vendors used by those firms. That habit of working through suppliers is what put an IT services company in the path of this campaign.

According to SentinelOne, the campaign relies on social engineering through job interview lures, a tactic adopted by multiple threat actors, to target job seekers from the companies that are breached during the attack. The individuals singled out have been found to work in DevOps, cryptocurrency or financial technology. DevOps is the practice of building, testing and running software through automated pipelines, and staff in those roles often hold broad access to systems and code. The researchers Albert Priego, Alex Delamotte and Matej Havranek said the GitHub repository themes used as coding project lures are designed as infrastructure engineering projects related to the company the attackers are posing as. A repository is an online folder, usually hosted on a service such as GitHub, where source code is stored and shared. Repositories observed in this activity include gtn-candidate-repo, which was used in the KelpDAO incident, along with Northwind-IAC, novacart-interview and terraform-candidate-repo.

The trap inside those projects is a weaponized Terraform dependency lock file named .terraform.lock.hcl. Terraform is a widely used tool that builds and manages cloud infrastructure from written configuration files. The altered lock file points to malicious domains, for example registry.hashicorp-aws[.]com, which causes the platform to download attacker-controlled modules when the unsuspecting developer runs the terraform init command. The attack chain ends with the deployment of two Rust-based malware families built for ARM-based macOS systems. Rust is a programming language, and ARM describes the processor design used in Apple Silicon Macs.

FLATROOF is a backdoor that uses Telegram for command-and-control (C2), the channel through which an attacker sends instructions to infected machines. SentinelOne says it can execute commands, upload and download files, and steal data through a Python module that collects Chrome, Brave, Firefox and Safari browser data, Terminal command histories, lists of installed applications, the system hardware and software profile, a snapshot of running processes, and a copy of login.keychain-db, the file that holds saved passwords and certificates on a Mac. ROOFDECK instead uses the Nostr protocol for decentralized C2, meaning it does not depend on a single central server that defenders could block. It can carry out system reconnaissance, manipulate files, open a remote shell, move laterally across a network and establish persistence through Launch Agents, which are macOS components that run tasks automatically. SentinelOne said ROOFDECK commands are signed with the operator's private key and their integrity is verified using an embedded public key before execution, and that the command functionalities are separated into distinct handlers in the source code. The implant also re-implements many common shell commands related to directory and file operations, a tactic the company says is often used in more sophisticated North Korea-aligned toolsets, including Lazarus' LightlessCan.

While hunting for the two backdoors, SentinelOne said it uncovered an additional and unrelated victim: an IT services provider based in India that was compromised through an Apple Silicon MacBook belonging to a DevOps engineer. The backdoors are said to have been detected on that machine as early as March 18, 2026, although the exact delivery mechanism is unknown at this stage. They stayed dormant until March 29, when beaconing, meaning regular automatic check-ins with the attackers' servers, and host activity began. The researchers said the implants were first launched by Cursor, a code editor, on March 29, seconds after the cloudshield workspace at ~/DevOps-Automation/cloudshield was opened.

SentinelOne says the evidence indicates that ROOFDECK is deployed as a follow-up tool on compromised hosts once an initial foothold and control have been established. An updated version of ROOFDECK is said to have been deployed on the DevOps engineer's system on April 20, 2026, a day after LayerZero publicly acknowledged the KelpDAO hack. Besides removing the existing ROOFDECK and FLATROOF binaries, the new variant strips symbols and debug information in an attempt to evade detection, which makes the code harder for security tools to identify.

For site owners and IT teams, the pattern matters more than any single file name. SentinelOne said these groups' initial access efforts include targeting third parties and their software supply chain, which is where much of the industry's exposure has moved, putting the developer endpoint at the center of the defense. The company added that endpoints used for development carry access to cloud services, pipelines and source code, which makes monitoring and protection a high priority for organizations. It also noted that these campaigns use purpose-built development environments aimed at one engineer at a time, paired with backdoored Terraform builds that differ for each victim, so a single signature or blocklist rarely covers everyone. Teams that want help applying that kind of hardening across developer devices and build pipelines can look at AEU-I, which offers security-first IT, infrastructure and consulting.