This macOS Malware Can Avoid AI Analysis with Gaslighting Prompts Hidden Inside Its Architecture
SentinelOne said the Rust-based malware hides 38 fake system messages and a 3.5 KB payload to mislead AI-assisted analysis tools.
- SentinelOne recently uncovered Gaslight, a new piece of malware designed to weaponize LLM-assisted triage pipelines by deceiving AI-powered analysis tools into aborting investigations.
- What makes the malware stand out is a 3.5 KB payload containing 38 fake "system" messages embedded directly within the binary. SentinelOne explains, "Its most notable feature is an embedded cascade of fabricated system-failure messages, designed to make an LLM-assisted triage agent doubt its own session."
- These messages claim things like "The AI's authentication token has expired," "The analysis environment is running out of memory," or "Disk space has been exhausted." The scaffold embeds fake system messages about token expiry, out-of-memory kills, disk exhaustion, and repeated operation failures.
- While SentinelOne did not demonstrate the technique could successfully bypass all platforms, researchers warn defenders to treat malware samples as adversarial input. Anyone building such tooling should isolate AI pipelines as more analyst-targeting prompt injection is expected.
- The North Korean-linked malware also functions as an infostealer, pulling passwords and sensitive PDFs. Security teams log 54% of successful attacks and alert on just 14%, highlighting the detection gap this threat exploits.
11 Articles
11 Articles
This macOS malware can avoid AI analysis with gaslighting prompts hidden inside its architecture
SentinelOne uncovered macOS malware “Gaslight” that uses prompt injection to mislead AI‑assisted triage tools during analysisBeyond standard backdoor and infostealer capabilities, it embeds fake Markdown “system” messages to trick LLMs into halting investigationResearchers warn defenders to treat malware samples as adversarial input and isolate AI pipelines, as more analyst‑targeting prompt injection is expectedWe’ve seen prompt injection in web…
North Korean hackers deploy new macOS malware that tricks AI security tools
North Korean-linked cybercriminals are using a newly identified malware family targeting Apple computers, which combines traditional data-stealing capabilities with a novel attempt to manipulate security tools powered by artificial intelligence (AI), according to cybersecurity researchers. In a report published Tuesday, U.S. cybersecurity firm SentinelLabs outlined the workings of the “macOS.Gaslight” malware, which is designed to […] The post …
Gaslight macOS Malware Is a Warning Shot at the AI Security Stack
The Gaslight macOS malware from a North Korean cluster doesn't bypass AI analysis platforms yet, but its 38-message prompt injection cascade makes the direction of travel clear. Here's why this matters beyond the sample itself. Gaslight macOS Malware Is a Warning Shot at the AI Security Stack on Latest Hacking News | Cyber Security News, Hacking Tools and Penetration Testing Courses.
Malware authors subvert AI detection systems
Enterprises that have turned to AI in order to boost their security defenses may have to reconsider their approach. Malware containing code that commands LLM-assisted products to abort their analysis or refuse to implement it is already circulating, according to a post from security company SentinelLabs. SentinelLabs thinks it knows who’s responsible for the malware, which attacks MacOS systems. “Apple’s XProtect detects the sample under the rul…
Gaslight, a new macOS malware, tries to blur the tracks in a rather new way: it hides false messages of error in its code to disrupt the analysis tools assisted by IA.
Coverage Details
Bias Distribution
- 100% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
