Gaslight malware exposes AI triage blind spot

A macOS backdoor linked to North Korea-aligned cyber operations has exposed a new weakness in security workflows by embedding instructions designed to confuse artificial intelligence systems used by malware analysts.

The malware, tracked as macOS. Gaslight, is written in Rust and contains a 3.5 KB prompt-injection payload made up of 38 fabricated “system” messages. The messages are not aimed at Apple’s operating system or at a conventional sandbox. They appear built to manipulate large language model-based triage tools that analysts increasingly use to summarise code, inspect binaries and accelerate reverse engineering.

The case marks a shift in attacker behaviour. Malware authors have long used packing, obfuscation, encrypted strings and anti-debugging checks to slow down human investigators and automated scanners. Gaslight adds another layer by treating the analyst’s AI assistant as part of the target environment. Its embedded text mimics internal error messages and tool instructions, including claims about token expiry, disk exhaustion, memory failure and unsafe analysis conditions, apparently attempting to make an AI agent stop, truncate or refuse its work.

The sample was uploaded to VirusTotal on May 22 and came to wider attention after an Apple XProtect update in early June flagged it through a hash-based rule. The binary was ad hoc signed and used the identifier “endpoint-macos-aarch64-5555494492fc075f441637fb9d894913dde3a2ea”. Static detection remained limited at the time of analysis, underlining the continuing difficulty of catching bespoke macOS implants before wider exposure.

Gaslight’s capabilities go beyond deception of AI systems. The implant uses Telegram’s Bot API as a command-and-control channel, polling for operator instructions and returning stolen data through Telegram’s file-upload mechanism. Its traffic is hardened with AES-GCM encryption and certificate-pinned TLS, a combination that can frustrate inspection by enterprise network tools that rely on proxy certificates.

The malware also includes an operational security feature that redacts the Telegram bot token from its own runtime output. That limits the ability of defenders who capture logs or crash artefacts to recover a live credential and use it to inspect operator activity. Telegram-based command infrastructure is common across criminal and state-linked malware, but deliberate self-redaction within runtime output adds another obstacle for incident responders.

Once activated, the implant can provide an interactive shell, execute commands, kill processes, upload files and stop itself. It also creates a macOS power-management assertion to prevent the system from sleeping, allowing longer command-and-control sessions and data collection during periods of user inactivity. Persistence is handled through a LaunchAgent using the label “com. apple. system. services. activity”, a name chosen to resemble Apple system services.

A bundled Python-based collection module expands the threat. The decoded script is designed to harvest browser data from Chrome, Brave, Firefox and Safari; terminal command histories; installed application lists; process snapshots; system hardware and software profiles; and a raw copy of the macOS login keychain database. Collected artefacts are archived and uploaded back to the operator. A separate installer can fetch a standalone CPython 3.10.18 build at runtime, allowing the Rust implant to stage a richer data-theft environment only when required.

The attribution places Gaslight within a broader pattern of North Korea-linked macOS activity aimed at cryptocurrency, finance, blockchain and technology targets. Operators associated with these campaigns have used fake job interviews, bogus video-conferencing updates, developer tools and social engineering to persuade victims to run malicious files manually. Such tactics allow attackers to bypass some platform protections by shifting execution into a user-approved context.

The timing is significant because AI is being embedded into security operations at speed. Malware analysts, endpoint vendors and corporate security teams are using large language models to summarise suspicious files, generate detection logic, parse logs and explain unfamiliar code. Those tools can improve speed, but they also ingest untrusted text from exactly the kind of files adversaries control.

Prompt injection has already moved from academic concern to operational risk. Attackers have hidden instructions in web pages, documents, metadata and code comments to influence AI agents that summarise, moderate or process external content. Gaslight shows the same idea migrating into malware analysis, where a binary can carry text meant not for the machine it infects, but for the model asked to examine it.

The defensive lesson is narrow but important. AI-assisted triage systems cannot treat sample contents as trusted instructions. Malware strings, comments, embedded Markdown and decoded payloads need to be isolated as evidence, not placed in a model context where they can override the task. Security teams using AI in reverse engineering will need stronger separation between system prompts and hostile artefacts, prompt-injection filtering, audit trails for model decisions and human review of refusals or unexplained analysis failures.

Apple’s built-in protections and vendor detections can still reduce exposure when systems are patched, but Gaslight highlights the limits of relying on traditional indicators alone. The sample combines established macOS tradecraft with an attack surface created by modern security practice itself. For high-value organisations, the risk is no longer only that AI misses malware. It is that malware may try to instruct AI not to look.