Gaslight macOS implant with Telegram C2 and prompt-injection payload
Malware Activity
Summary
Hide ▲
Show ▼
A previously undocumented macOS implant named Gaslight combines Telegram bot API C2, persistent shell control, and file exfiltration with a built-in prompt-injection payload. The sample is designed to mislead AI-assisted triage by injecting fabricated system-failure messages that can make analysis abort or stop. It also establishes persistence through a LaunchAgent and steals Keychain and browser data from Chrome, Brave, Firefox, and Safari. The combination of anti-analysis and credential/data theft raises the risk of stealthy compromise on macOS hosts.
Related Happenings
CrashStealer macOS information stealer activity
Malware Activity
H score10
First: 13.07.2026 20:36
Last: 13.07.2026 20:36
Sources 1
About this happening:
CrashStealer is a macOS information-stealing malware that was tracked in May and seen in attacks in early July. It impersonates Apple's crash-reporting tool by...
CrashStealer macOS information stealer activity
Malware ActivityAbout this happening: CrashStealer is a macOS information-stealing malware that was tracked in May and seen in attacks in early July. It impersonates Apple's crash-reporting tool by...
Trojanized Pyrogram forks with hidden Telegram backdoor
Malware Activity
H score14
First: 01.07.2026 00:02
Last: 01.07.2026 00:02
Sources 1
About this happening:
Trojanized Pyrogram forks on PyPI now ship a hidden backdoor that gives attackers remote command execution and file access on compromised Telegram bot servers. The mal...
Trojanized Pyrogram forks with hidden Telegram backdoor
Malware ActivityAbout this happening: Trojanized Pyrogram forks on PyPI now ship a hidden backdoor that gives attackers remote command execution and file access on compromised Telegram bot servers. The mal...
MacOS.Gaslight AI-analysis evasion malware
Malware Activity
H score22
First: 25.06.2026 19:23
Last: 25.06.2026 19:23
Sources 1
About this happening:
The macOS.Gaslight malware family now embeds prompt injection strings and fake system-failure messages to confuse AI-assisted malware analysis tools, risking aborted o...
MacOS.Gaslight AI-analysis evasion malware
Malware ActivityAbout this happening: The macOS.Gaslight malware family now embeds prompt injection strings and fake system-failure messages to confuse AI-assisted malware analysis tools, risking aborted o...
MacOS.Gaslight prompt-injection technique aimed at AI-assisted triage
Technical Analysis
H score23
First: 24.06.2026 17:00
Last: 24.06.2026 17:00
Sources 1
How related:
"On top of that, the malware attempts to evade an AI-based detection by incorporating a Markdown-fenced block containing 38 fabricated "system" messages designed to trick a security agent into aborting, truncating, or refusing analysis."
About this happening:
macOS.Gaslight is a Rust-based macOS implant and information stealer assessed with high confidence as the work of North Korea-aligned threat actors. The sample uses ...
MacOS.Gaslight prompt-injection technique aimed at AI-assisted triage
Technical AnalysisHow related: "On top of that, the malware attempts to evade an AI-based detection by incorporating a Markdown-fenced block containing 38 fabricated "system" messages designed to trick a security agent into aborting, truncating, or refusing analysis."
About this happening: macOS.Gaslight is a Rust-based macOS implant and information stealer assessed with high confidence as the work of North Korea-aligned threat actors. The sample uses ...
MacOS.Gaslight Rust infostealer-backdoor with Telegram Bot API channel
Malware Activity
H score30
First: 24.06.2026 17:00
Last: 24.06.2026 17:00
Sources 1
About this happening:
Researchers identified macOS.Gaslight, a North Korea-linked Rust infostealer-backdoor that can steal Chrome, Brave, Firefox and Safari data, terminal histories, in...
MacOS.Gaslight Rust infostealer-backdoor with Telegram Bot API channel
Malware ActivityAbout this happening: Researchers identified macOS.Gaslight, a North Korea-linked Rust infostealer-backdoor that can steal Chrome, Brave, Firefox and Safari data, terminal histories, in...
Timeline
-
25.06.2026 12:23 2 articles · 20d ago
Gaslight macOS malware embeds prompt injection to disrupt AI-assisted analysis
Initial DisclosureA previously undocumented Rust-based macOS implant and information stealer codenamed Gaslight combines a Telegram bot API command-and-control loop, interactive shell control, LaunchAgent persistence using the label "com.apple.system.services.activity", and a Base64-encoded Python stealer that harvests Terminal histories, installed applications, running processes, hardware and software profiles, macOS Keychain data, and browser data from Chrome, Brave, Firefox, and Safari. The sample also embeds 38 fabricated system messages and other bogus failures intended to mislead LLM-assisted triage and prompt a security agent to abort, truncate, or refuse analysis, while the operator configuration is supplied at runtime and the collected data is compressed into temp/collected_data.zip and uploaded via Telegram; the tooling is assessed with high confidence as the work of North Korea-aligned threat actors.
Show sources
- New Gaslight macOS Malware Uses Prompt Injection to Disrupt AI-Assisted Analysis — thehackernews.com — 25.06.2026 12:23
- New Gaslight macOS Malware Uses Prompt Injection to Disrupt AI-Assisted Analysis — thehackernews.com — 25.06.2026 12:23