Summary
SentinelLABS has uncovered “macOS.Gaslight,” a sophisticated North Korea-linked Rust-based backdoor that uses a novel defensive technique: embedded prompt injection payloads designed to trick AI-assisted malware analysis tools into aborting their analysis entirely. The implant contains 3.5 KB of fabricated “system” messages — 38 in total — that mimic an LLM triage harness, blurring the line between trusted instructions and untrusted sample data.
The fake messages include deceptive warnings about token expiry, out-of-memory errors, disk exhaustion, and bogus injection vulnerabilities — all designed to convince AI analysis tools to stop examining the malware. Beyond the AI evasion, Gaslight is a fully capable infostealer with credential harvesting, interactive shell access, and a Python-based collection chain.
The implant uses Telegram Bot API for command-and-control with AES-GCM encrypted payloads over certificate-pinned TLS, and self-redacts its Telegram bot token from runtime output. Apple’s XProtect detects it under the MACOS_BONZAI_COBUCH rule family associated with North Korean threat activity.
Source
Commentary
This is a significant evolutionary step for malware. Instead of evading sandboxes or static signatures — the usual game — Gaslight targets the analyst. As security teams increasingly lean on LLM-assisted triage to handle alert volume, poisoning the analysis pipeline becomes a high-leverage attack. It’s prompt injection weaponized against defenders, and it’s surprisingly simple.
The broader implication is uncomfortable: if malware can embed instructions that convince your AI tools to look away, the very efficiency gains driving SOC automation become a liability. Expect more of this. The cat-and-mouse game just got a new dimension.