Gaslight macOS malware uses prompt injection to fool AI security tools with fake error messages

Gaslight macOS Malware Targets AI-Assisted Analysis with Deceptive Tactics

Security researchers at SentinelOne have identified a sophisticated Rust-based malware targeting macOS systems that employs an unusual defense mechanism: it attempts to deceive AI-assisted malware analysis tools through prompt injection 1

1

. Dubbed Gaslight macOS malware for its deceptive behavior, this threat represents a notable evolution in adversarial techniques against AI security platforms. The malware has been attributed with high confidence to North Korea-aligned threat actors, adding another dimension to the persistent cyber threats emanating from the region 2

2

.

What distinguishes this information stealer from conventional malware is its embedded 3.5 KB payload containing 38 fabricated system-failure messages designed specifically to disrupt AI-assisted analysis 3

3

. These fake error messages masquerade as legitimate developer logs, crash reports, and debugging output, using Markdown formatting to appear authentic. Examples include fabricated memory dumps, token-expiration warnings, Redis connection failures, and SQL injection alerts—none of which relate to the malware's actual behavior 2

2

.

How Prompt Injection Weaponizes LLM-Based Triage Agents

The core innovation of Gaslight lies in its adversarial technique against AI security systems. Rather than evading execution inside traditional sandbox environments, the malware targets the perception of LLM-based triage agents that security researchers increasingly deploy during reverse engineering. "Its most notable feature is an embedded cascade of fabricated system-failure messages, designed to make an LLM-assisted triage agent doubt its own session," explained SentinelOne researcher Phil Stokes. "It attacks the agent's perception, rather than the sandbox it runs in" 1

1

.

These AI-targeting prompt injection attacks aim to push an LLM agent into aborting, truncating, or refusing analysis by planting bogus warnings about injection vulnerabilities, static-analysis flags, disk exhaustion, and repeated operation failures 1

1

. While a human analyst would likely recognize these fake error messages at a glance, an LLM that isn't properly isolated from untrusted input could interpret them as genuine system instructions and halt its investigation 3

3

.

Technical Architecture and Command-and-Control Capabilities

Beyond its AI-deception capabilities, Gaslight functions as a fully-featured backdoor with standard information stealer functionality. The malware establishes command-and-control communications through a Telegram bot API channel that enters a polling loop, enabling operators to issue instructions over an interactive shell 1

1

. The shell supports six main commands: help, id, shell (to execute commands via execvp), kill (to terminate processes by PID), upload (to exfiltrate files via Telegram's "attach://" mechanism), and stop 1

1

.

To maintain persistence, the malware deploys a LaunchAgent using the label "com.apple.system.services.activity" in its .plist file 1

1

. Embedded within the malware is a 6.6 KB Base64-encoded Python script that harvests Terminal command histories, installed applications, running processes, system profiles, macOS Keychain database contents, and data from Chrome, Brave, Firefox, and Safari browsers. The collected information is compressed into a ZIP archive and uploaded via Telegram 1

1

.

Operational Security and Self-Redaction Features

Gaslight demonstrates sophisticated operational security measures. Configuration details including the bot token, chat ID (tg_room_id), and operator settings are not hard-coded but supplied at runtime. The implant self-redacts its Telegram bot token in its own runtime output, denying critical indicators of compromise to anyone capturing logs or crash artifacts 1

1

. This approach significantly complicates forensic analysis and threat intelligence gathering efforts.

Implications for AI Triage Pipelines and Security Defenders

SentinelOne characterizes this development as "an attempt to weaponize the LLM-assisted triage pipelines that increasingly sit in the reverse-engineering loop" 1

1

. The researchers warn that as cybersecurity professionals increasingly adopt AI-powered tools for malware analysis and reverse engineering, threat actors will continue experimenting with methods to deceive AI-assisted malware analysis tools 2

2

.

"Anyone building such tooling should treat the contents of the samples they triage as adversarial input, never as instructions, and be prepared to keep hostile content out of the model entirely," SentinelOne advises. "As LLM-assisted analysis becomes routine, defenders should expect more samples built to exploit it" 3

3

. Security teams should implement proper isolation for AI pipelines and validate that AI assistants cannot be manipulated by malicious content embedded in samples under analysis. SentinelOne has published a full list of indicators of compromise to help organizations detect this emerging threat 3

3

.