macOS Gaslight Backdoor Weaponizes Prompt Injection Against Security Analysts

Researchers have uncovered a clever new macOS implant called Gaslight that introduces a novel evolution in attacker tradecraft by utilizing prompt injection to target security analysts and LLM-assisted triage tools rather than just the sandbox environment. 

Gaslight is a Rust-based backdoor that researchers from SentinelOne have attributed to DPRK-aligned threat actors, and Apple’s XProtect detects the sample under the MACOS_BONZAI_COBUCH signature family. SentinelOne researchers first noticed the backdoor in early June when Apple added the signature for it to XProtect. The most notable feature of Gaslight is its defensive strategy, which pivots from conventional sandbox evasion to active deception of the investigative process. 

The implant embeds a 3.5 KB Markdown-fenced blob of malicious data containing 38 fabricated system messages, specifically delimited by {{DATA}} tokens. This structure is specifically designed to mimic the prompt scaffold of an LLM triage harness. By planting bogus warnings about memory kills, disk exhaustion, and simulated injection vulnerabilities, the malware tries to trick automated analysis tools into aborting, truncating, or misinterpreting the security session, effectively gaslighting the analyst into ignoring the infection.

The researchers tied the Gaslight implant to North Korean attackers. 

“We assess with high confidence that this implant sits within a cluster of DPRK-aligned macOS activity. Apple’s XProtect detects the sample under the rule MACOS_BONZAI_COBUCH, and SentinelLABS associates the BONZAI signature family with North Korean threat activity. A sibling BONZAI sample is additionally caught by Apple’s AIRPIPE rule, a family SentinelLABS likewise ties to North Korean activity,” Phil Stokes of SentinelLABS said in a post. 

“We assess with high confidence that this implant sits within a cluster of DPRK-aligned macOS activity."

Technically, Gaslight exhibits real maturity in its evasion tactics. To avoid static analysis, it resolves its API calls at runtime via dlsym, steering clear of static symbol tables, and determines its own executable location dynamically. Persistence is maintained by preventing host sleep, which ensures the backdoor can keep its command-and-control polling alive even during periods of user inactivity. The implant also demonstrates an awareness of its network environment, querying system proxy configurations via SCDynamicStoreCopyProxies to ensure its traffic remains routable through standard network stacks.

Communication with the attacker is handled via a command-and-control loop operating over the Telegram Bot API, utilizing AES-GCM encrypted payloads over certificate-pinned TLS. To giard against the risk of defenders recovering the Telegram bot token—a frequent issue in bot-based C2—Gaslight employs runtime self-redaction, stripping the token from its own output to prevent recovery from crash artifacts or memory dumps. Configuration management within the implant is handled by the serde framework, allowing the operator to provide a config blob that the malware parses at runtime.

“Persistence is achieved through a LaunchAgent. This implant’s plist carries the Label value com.apple.system.services.activity. Masquerading within Apple’s com.apple.* namespace is a tactic widely used in many macOS malware families, including those previously tied to DPRK-linked activities,” Stokes said.

Once successfully deployed, Gaslight acts as a comprehensive infostealer. It harvests a wide array of sensitive data, including credentials from browser storage across Chrome, Safari, Firefox, and Brave, as well as terminal command histories, installed application listings, and process snapshots captured via ps aux. Crucially, the implant also targets the host's login keychain-db, facilitating deeper compromise of the victim's local and cloud credentials. 

The emergence of Gaslight is part of a broader trend in malware development, in which threat actors are increasingly prioritizing the manipulation of the AI and machine-learning tools that organizations rely on for rapid threat intelligence and incident response.