Gaslight macOS Malware Uses Prompt Injection to Trick AI Analysts

Security researchers at SentinelOne have uncovered a previously undocumented Rust-based macOS implant dubbed Gaslight, attributed with high confidence to North Korea-aligned threat actors. The malware's most distinctive feature is an embedded cascade of fabricated system-failure messages designed to prompt-inject LLM-assisted triage agents, making them doubt their own session and abort analysis of the artifact. According to SentinelOne researcher Phil Stokes, "It attacks the agent's perception, rather than the sandbox it runs in" — a novel tactic that weaponizes AI analysis workflows against defenders themselves.

The implant communicates with operators through a Telegram bot API-based command-and-control channel that polls for instructions, executes commands, and returns results over an interactive shell. Six primary commands are supported: help, id, shell, kill, upload, and stop, with researchers identifying signs of a seventh "focus" command whose functionality remains undetermined. Persistence is achieved via a LaunchAgent labeled "com.apple.system.services.activity" in its .plist file. Notably, the bot token, chat ID, and operator configuration are supplied at runtime rather than hard-coded, and the implant self-redacts its Telegram bot token in its own runtime output to frustrate forensic analysis.

Gaslight also bundles a 6.6 KB Base64-encoded Python information stealer deployed via a 2 KB bash installer that drops a cpython-3.10.18 interpreter from the astral-sh/python-build-standalone project. The presence of emojis and verbose comment headers strongly suggests the Python payload was generated using a large language model. The stealer harvests Terminal command histories, installed application listings, running process snapshots, system hardware/software profiles, the macOS Keychain database, and credential data from Chrome, Brave, Firefox, and Safari — compressed into a ZIP archive and exfiltrated via Telegram's attach:// mechanism.

With infostealers increasingly targeting browser-stored credentials and Keychain secrets, users should verify whether their passwords have appeared in known leaks using a email breach checker and audit password strength and uniqueness through a password checker. Given the malware's reliance on Telegram for C2 and the growing wave of LLM-generated stealers, defenders should also review their browser's exposed fingerprint surface via a browser fingerprint test to minimize identifiable telemetry that could aid targeting.