MacOS.Gaslight AI-analysis evasion malware
Malware Activity
Summary
Hide ▲
Show ▼
The macOS.Gaslight malware family now embeds prompt injection strings and fake system-failure messages to confuse AI-assisted malware analysis tools, risking aborted or truncated triage. The sample is a Rust binary with backdoor and information-stealing functionality, and it contains a 3.5 KB payload with 38 fake system messages meant to mislead automated analysis.
Related Happenings
CrashStealer macOS information stealer activity
Malware Activity
H score10
First: 13.07.2026 20:36
Last: 13.07.2026 20:36
Sources 1
About this happening:
CrashStealer is a macOS information-stealing malware that was tracked in May and seen in attacks in early July. It impersonates Apple's crash-reporting tool by...
CrashStealer macOS information stealer activity
Malware ActivityAbout this happening: CrashStealer is a macOS information-stealing malware that was tracked in May and seen in attacks in early July. It impersonates Apple's crash-reporting tool by...
Gaslight macOS implant with Telegram C2 and prompt-injection payload
Malware Activity
H score29
First: 25.06.2026 12:23
Last: 25.06.2026 12:23
Sources 1
About this happening:
A previously undocumented macOS implant named Gaslight combines Telegram bot API C2, persistent shell control, and file exfiltration with a built-in prompt-i...
Gaslight macOS implant with Telegram C2 and prompt-injection payload
Malware ActivityAbout this happening: A previously undocumented macOS implant named Gaslight combines Telegram bot API C2, persistent shell control, and file exfiltration with a built-in prompt-i...
MacOS.Gaslight prompt-injection technique aimed at AI-assisted triage
Technical Analysis
H score23
First: 24.06.2026 17:00
Last: 24.06.2026 17:00
Sources 1
How related:
"Its most notable feature is an embedded cascade of fabricated system-failure messages, designed to make an LLM-assisted triage agent doubt its own session," explains SentinelOne.
About this happening:
macOS.Gaslight is a Rust-based macOS implant and information stealer assessed with high confidence as the work of North Korea-aligned threat actors. The sample uses ...
MacOS.Gaslight prompt-injection technique aimed at AI-assisted triage
Technical AnalysisHow related: "Its most notable feature is an embedded cascade of fabricated system-failure messages, designed to make an LLM-assisted triage agent doubt its own session," explains SentinelOne.
About this happening: macOS.Gaslight is a Rust-based macOS implant and information stealer assessed with high confidence as the work of North Korea-aligned threat actors. The sample uses ...
SHub Reaper macOS infostealer variant
Malware Activity
H score23
First: 19.05.2026 00:42
Last: 19.05.2026 00:42
Sources 1
About this happening:
The SHub Reaper macOS infostealer now uses AppleScript and a fake Apple security update lure to infect Macs, raising the risk of credential theft and remote access. It...
SHub Reaper macOS infostealer variant
Malware ActivityAbout this happening: The SHub Reaper macOS infostealer now uses AppleScript and a fake Apple security update lure to infect Macs, raising the risk of credential theft and remote access. It...
Fast16 Lua-based network worm
Malware Activity
H score14
First: 27.04.2026 16:09
Last: 27.04.2026 16:09
Sources 1
About this happening:
Researchers identified fast16, a previously undocumented Lua-based network worm that can silently corrupt high-precision calculations and threaten legacy scientific and en...
Fast16 Lua-based network worm
Malware ActivityAbout this happening: Researchers identified fast16, a previously undocumented Lua-based network worm that can silently corrupt high-precision calculations and threaten legacy scientific and en...
Timeline
-
25.06.2026 19:23 2 articles · 20d ago
Gaslight macOS malware uses fake system errors to mislead AI analysis tools
Initial DisclosureA newly discovered macOS malware family dubbed Gaslight embeds prompt injection strings and fake debugging data inside a Rust binary to confuse AI-assisted malware analysis tools and LLM-assisted triage agents. The sample includes a 3.5 KB payload with 38 fake system messages, backdoor and information-stealing functionality, and is attributed with high confidence to a North Korean-linked threat actor.
Show sources
- New macOS malware embeds fake errors to confuse AI analysis tools — www.bleepingcomputer.com — 25.06.2026 19:23
- New macOS malware embeds fake errors to confuse AI analysis tools — www.bleepingcomputer.com — 25.06.2026 19:23