macOS.Gaslight Rust Backdoor Uses Prompt Injection to Mislead AI Malware Analysts

A new macOS malware family, dubbed macOS.Gaslight has emerged with a novel evasion technique designed specifically to target artificial intelligence.

Discovered in early June after an Apple XProtect update, this Rust-based backdoor uses embedded prompt injection to deceive LLM-assisted malware analysis tools.

While static engines on VirusTotal initially missed the ad hoc signed binary, researchers associate this implant with the DPRK-aligned BONZAI signature family.

A sibling BONZAI sample was also flagged by Apple’s AIRPIPE rule, further reinforcing the connection to North Korean threat activity.

macOS.Gaslight serves as both a persistent implant and a highly capable infostealer. Unlike traditional malware that attempts to evade virtual sandboxes, this variant attacks the perception of the automated triage agent itself.

The developers packed the binary with sophisticated payloads intended to compromise macOS systems while keeping its operations hidden from modern AI-driven defenders.

Gaslight Backdoor Misleads Analysts

The most striking feature of macOS.Gaslight is its aggressive approach to thwarting AI-assisted reverse engineering. The binary contains a Markdown-fenced block of 38 fabricated system messages delimited by specific data tokens.

This scaffold mimics the prompt structure of a typical LLM triage harness, blurring the boundary between trusted instructions and untrusted sample data.

By feeding the AI fake alerts about token expiry, disk exhaustion, and out-of-memory errors, the malware actively pushes the LLM agent to abort or truncate its analysis.

Beyond its evasion tactics, the malware includes a potent data-collection module that extracts sensitive user information. It utilizes a base64-encoded Python script that acts as a comprehensive infostealer.

To execute this script without relying on the host system’s native environment, a separate bash script fetches and stages a self-contained CPython interpreter directly from an open-source repository.

Interestingly, these deployment scripts use widespread emoji and include strict comment headers, strongly suggesting they were generated by artificial intelligence.

macOS.Gaslight establishes a robust command-and-control channel using the Telegram Bot API. The implant continuously polls for updates, using specific error codes to prevent multiple instances from running simultaneously.

To secure transit, all payloads are encrypted with AES-GCM, and the malware employs custom certificate pinning to prevent network-level inspection.

It also honors host proxy settings, ensuring the malicious connection remains active even in tightly managed enterprise environments, sentinelone said.

The implant maintains persistence by masquerading as a legitimate Apple system service.

It creates a LaunchAgent with a deceptive label to ensure it survives reboots, and it actively blocks system sleep to keep its polling loop running during periods of user inactivity.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.