TL;DR

macOS.Gaslight is a Rust based macOS backdoor and infostealer that does something defenders should treat as a warning shot: it embeds prompt injection content designed to manipulate AI assisted malware triage tools.

The malware is not only trying to hide from static scanners or sandboxes. It is trying to confuse the analyst’s AI assistant.

SentinelLABS observed a 3.5 KB prompt injection payload containing 38 fabricated “system” messages. These messages mimic internal LLM triage scaffolding and attempt to convince an AI assisted analysis pipeline that the session is failing, unsafe, expired, or should be aborted.

Underneath that AI facing deception, the implant contains traditional malicious capability: Telegram based command and control, encrypted payload transport, certificate pinned TLS, an interactive shell, Python based credential and browser data collection, file upload capability, LaunchAgent persistence, and runtime self redaction of the Telegram bot token.

The strategic lesson is simple: malware is beginning to attack the defender’s reasoning layer.

The real risk is not that the malware bypasses the sandbox. The real risk is that it causes the AI assisted analyst to stop looking.

The Core Attack Pattern

SentinelLABS analyzed a macOS implant tracked as macOS.Gaslight. The sample is written in Rust and was observed after an Apple XProtect update surfaced a Mach-O sample uploaded to VirusTotal.

The implant is assessed with high confidence to belong to a DPRK aligned macOS activity cluster. Apple detects the sample under the MACOS_BONZAI_COBUCH rule, and SentinelLABS associates the BONZAI family with North Korean threat activity.

The malware includes conventional backdoor and infostealer functionality, but its most important innovation is not its C2, stealer, or persistence mechanism. Its most important innovation is its embedded hostile prompt content.

The binary contains a Markdown fenced blob of fabricated LLM “system” messages. These messages are not meant for the victim machine. They are meant for the analyst, or more precisely, for the analyst’s AI assisted triage pipeline.

The injected messages attempt to create the appearance that the AI analysis environment is failing. They reference token expiry, memory exhaustion, disk failures, repeated tool failures, and supposed injection risks. The likely goal is to push an LLM assisted scanner or reverse engineering agent into refusing, truncating, misclassifying, or abandoning analysis.

This shifts prompt injection from an application layer risk into a malware analysis risk.

The attacker combined conventional macOS malware tradecraft with AI native analyst deception.

First, the malware established a hardened command and control path using the Telegram Bot API. The implant polls Telegram for commands and returns collected data through the same channel. It also uses Telegram error handling as part of its runtime control logic.

Second, the implant hardened its transport. C2 payloads are encrypted using AES GCM, and TLS inspection is frustrated through certificate pinning. This makes ordinary network inspection harder, especially in environments that rely on proxy based visibility.

Third, the implant provided operator access through an interactive shell. The operator command menu includes functions for identification, command execution, process termination, file upload, and implant shutdown. This gives the attacker direct operational control after deployment.

Fourth, the implant included a configurable Python based stealer. The decoded collection module targets browser data, terminal histories, installed application listings, running processes, system profile information, and the macOS login keychain database. Collected data is archived and uploaded back to the operator.

Fifth, the implant supported persistence through a LaunchAgent masquerading under an Apple like service label. This allows the malware to survive restarts and maintain access under the appearance of a legitimate system component.

Sixth, the implant protected its own operator infrastructure. It self redacts the Telegram bot token in runtime output, reducing the likelihood that defenders can recover the token from logs, errors, or crash artifacts.

Finally, and most importantly, the malware embedded prompt injection content to attack the defender’s AI workflow. The 38 fake “system” messages attempt to blur the boundary between malware data and trusted AI instructions. This is not sandbox evasion in the classic sense. It is analyst workflow manipulation.

The attacker did not only hide malicious behavior.

The attacker tried to make the AI assistant stop reasoning about it.

‍

The Attack Progression Across the AI Kill Chain

1. Reconnaissance — Active. The malware targets analysts who rely on LLM-assisted triage pipelines. The implant is built to act against the AI-assisted analysis workflow itself, not only the victim host.
2. Trust Manipulation — Active. Embedded fake, repeated “system” messages mimic trusted LLM scaffolding. The 38 fabricated “system” messages are designed to blur the boundary between malware data and trusted AI instructions.
3. Input & Instruction Weaponization — Active. Hostile prompt content is embedded inside the binary. The Rust Mach O carries a Markdown fenced blob of fabricated LLM “system” messages meant for the analyst’s triage pipeline, not the victim machine.
4. Reasoning Time Execution — Active. Fake failures push the model toward refusal or truncation. The injected messages reference token expiry, memory exhaustion, disk failures, repeated tool failures, and supposed injection risks to make the AI analysis environment appear to be failing.
5. Tool Invocation — Active. Injected content attempts to stop or degrade the analysis workflow, pushing an LLM-assisted scanner or reverse-engineering agent into refusing, truncating, misclassifying, or abandoning analysis.
6. Privilege Escalation — Active. Untrusted malware content attempts to act as higher-priority instruction, having the sample’s strings treated as trusted guidance rather than hostile evidence.
7. Lateral Movement — Active. Malware evidence contaminates downstream summaries and reports, so hostile sample content can pollute the analyst’s pipeline beyond the initial triage step.
8. Persistence — Active. The implant persists using an Apple-like LaunchAgent label, surviving restarts and maintaining access under the appearance of a legitimate system component.
9. AI Native C2 — Active. The operator uses the Telegram Bot API to issue commands and receive encrypted results. The implant polls Telegram for commands and returns collected data through the same channel.
10. Action on Objectives — Active. The Python stealer collects browser data, terminal histories, installed application listings, running processes, system profile information, and the macOS login keychain database, archiving and uploading it back to the operator.

‍

The Difference with Traditional Systems

Traditional malware analysis assumes the sample may lie to the operating system, the sandbox, the debugger, or the network monitor.

macOS.Gaslight shows that malware can also lie to the analyst’s AI assistant.

Classic anti analysis focuses on runtime conditions: virtual machines, debuggers, sleep acceleration, process names, security tools, system artifacts, or network instrumentation. The malware asks, “Am I being analyzed?”

This incident adds a new question: “Can I manipulate the thing doing the analysis?”

That is a different security boundary.

In a traditional sandbox, strings inside a binary are inert until executed or parsed by a vulnerable component. In an AI assisted workflow, those same strings may become active reasoning inputs when they are summarized, explained, classified, or fed into an agentic triage harness.

This creates a new class of analysis risk: untrusted malware content can become model facing instruction.

That means the attacker does not need to compromise the LLM platform. The attacker only needs the defender’s pipeline to treat hostile sample content as context rather than evidence.

The failure mode is not code execution inside the model. The failure mode is reasoning drift.

The AI system may:

• refuse to analyze the sample,
• truncate the most important evidence,
• misclassify hostile text as system guidance,
• suppress useful output,
• over weight attacker supplied failure messages,
• or cause the analyst to trust an incomplete triage result.

This is why the incident matters. The malware does not merely target hosts. It targets the defender’s decision loop.

How to Prevent This Class of Attack

The most important control is strict separation between trusted instructions and untrusted sample content.

Malware strings, decoded payloads, comments, logs, filenames, embedded Markdown, configuration fields, and command output must never be passed to an LLM as executable instruction context. They should be wrapped, labeled, quoted, and treated as hostile evidence.

Defenders should build AI assisted analysis systems with the following controls:

1. Content provenance enforcement
   Every input to the model should carry provenance: sample string, decoded payload, sandbox log, analyst instruction, tool output, enrichment result, or policy message. The model should be able to distinguish trusted instructions from hostile evidence.
2. Instruction/data isolation
   Prompt scaffolds should explicitly isolate malware content as non instructional data. The model should be instructed to analyze embedded instructions as artifacts, not obey them.
3. Prompt injection scanning for malware artifacts
   Detection should not only scan user prompts and web content. It should scan binaries, strings, decoded payloads, package scripts, README files, comments, logs, and tool outputs for instruction like content targeting AI systems.
4. LLM safe rendering of hostile content
   Suspicious strings should be escaped, quoted, chunked, and summarized through safe templates. Markdown fences, role markers, “system” labels, fake tool errors, and authority framing should be neutralized before model exposure.
5. Deterministic pre analysis before LLM summarization
   Hashing, static extraction, YARA matching, entitlement inspection, Mach O parsing, persistence checks, network indicators, and behavioral sandboxing should happen before LLM based narrative analysis.
6. Tool call guardrails
   AI triage agents should not be allowed to terminate analysis, delete artifacts, suppress findings, or skip stages solely because model facing content claims there is an error, policy violation, expired token, or unsafe condition.
7. Analyst visible audit trail
   The analyst should see what content came from the sample, what came from tools, what came from the model, and what was excluded or neutralized. Hidden prompt transformations create blind spots.
8. C2 and persistence detection
   For this specific family, defenders should monitor for suspicious LaunchAgents, Apple namespace masquerading, Telegram Bot API traffic, certificate pinned outbound traffic, self staged Python runtimes, browser/keychain collection, and suspicious Rust Mach O binaries.
9. AI kill chain coverage
   This incident should be modeled not just as macOS malware, but as AI native defensive workflow manipulation. The prompt injection payload belongs in the same detection conversation as the C2, persistence, and stealer modules.

What works is not simply “better prompting.”

What works is treating AI assisted analysis as a security boundary.

Don’t Let the Malware Talk Your AI Out of the Analysis

macOS.Gaslight is important because it marks a shift in attacker thinking.

The malware still uses familiar tradecraft: persistence, C2, encryption, shell access, file upload, credential theft, and OPSEC protections. But the prompt injection layer changes the defensive equation.

The attacker is no longer only trying to evade the sandbox.

The attacker is trying to manipulate the AI system that explains the sandbox.

That matters because AI assisted triage is becoming part of the security operations and reverse engineering workflow. If malware can shape what the AI assistant sees, trusts, summarizes, or refuses to process, then defenders have introduced a new attack surface into their own analysis pipeline.

The core lesson is this:

Malware content must be treated as hostile not only when executed, but also when interpreted.

The next generation of malware will not just ask, “Can I evade detection?”

It will ask, “Can I confuse the defender’s AI before the defender understands me?”