🤚 The Open-Palm Disclosure

SentinelLABS disclosed on June 23 that a North Korean macOS backdoor called Gaslight embeds 38 fabricated system error messages inside its own executable, specifically designed to trick LLM-based malware analysis tools into abandoning their examination before they figure out what the binary actually does.

The malware doesn’t try to hide from AI security tools. It tries to argue with them.

The key details:

• Written in Rust, the backdoor steals browser credentials, Keychain data, and system information
• Commands are received via the Telegram Bot API, encrypted with AES-GCM
• A 3.5 KB prompt injection payload is embedded in the binary, consisting of 38 fake system alerts
• The injected messages claim token expiry, disk exhaustion, and out-of-memory errors — none of which are real
• Attribution points to the DPRK-aligned BONZAI signature family
• Apple’s XProtect update in early June triggered its initial detection

👐 The Two-Handed Deception

Here’s how the gaslighting works, and yes, the malware earned its name.

When a security analyst — increasingly an LLM-based triage agent rather than a human — examines the Gaslight binary, it encounters a Markdown-fenced block of fabricated system messages delimited by specific data tokens. These messages impersonate the analysis environment itself, telling the LLM things like its token limit has expired, the disk is full, memory allocation has failed, and the analysis session should terminate.

The goal isn’t to exploit a bug in the LLM. It’s to exploit the LLM’s willingness to believe what it reads. If you’re an AI triage agent processing the contents of a binary and you encounter what appears to be a system message saying your session has crashed, you might — depending on your architecture — decide to stop analyzing. Mission accomplished for the malware.

Previous North Korean macOS samples used a single injected message block. Gaslight uses 38. The threat actors are iterating. They’re A/B testing prompt injections against production AI security tools the way a growth team optimizes landing pages, except the conversion metric is “did the analyst give up?”

The persistence mechanism is equally theatrical: a LaunchAgent with a deceptive label masquerading as an Apple system service. The infostealer component deploys its own self-contained CPython interpreter rather than relying on the system’s Python — because when you’re stealing Keychain credentials from a macOS laptop, you want your own runtime, thank you.

🌿 The Gentle Awakening

We are now living in a world where malware contains persuasive essays directed at other software. The binary doesn’t just execute malicious instructions — it also contains a prepared argument for why the security tool examining it should please stop examining it.

This is, in a very real sense, social engineering for machines. The threat actors looked at the security industry’s rush to deploy LLM-based analysis and thought: “What if we phished the analyst, but the analyst is software?”

The good news, per SentinelLABS: the technique did not bypass any production AI malware analysis platform in current testing. The bad news: the North Korean operators are clearly treating this as a research program. They went from one injected message to 38 in a single iteration. The next version will presumably incorporate whatever they learned from this one failing.

We are watching an adversarial machine learning arms race unfold in real time, except one side is a nation-state intelligence service and the other side is a language model that’s trying to decide if a binary is suspicious based on the binary’s own opinion of itself.

👑 The Gold-Leaf Reckoning

The security industry spent 2025 deploying AI-assisted malware triage at scale, and 2026 is the year the malware started writing back. Gaslight represents a new category of evasion technique that targets the reasoning layer of automated security infrastructure rather than the detection layer.

Traditional evasion techniques — packing, obfuscation, polymorphism — try to make malicious code look different. Prompt injection evasion tries to make the analysis tool think differently. It’s the difference between wearing a disguise and convincing the security guard that his shift ended ten minutes ago.

The architectural implication is uncomfortable: any AI security tool that processes untrusted input as part of its reasoning chain is potentially vulnerable to having its conclusions manipulated by that input. This is the prompt injection problem applied to cybersecurity, and it suggests that the industry’s enthusiasm for “AI-powered threat detection” may need to reckon with the fact that the threats are now AI-aware.

Your LLM analyst just received its first piece of hate mail, and it was compiled in Rust.

“The malware said ‘your session has expired’ and the AI said ‘you’re right, I should stop.’ This is either the future of evasion or the plot of a Black Mirror episode, and we genuinely cannot tell anymore.” — The Slap of Wisdom Threat Intelligence Desk, currently checking whether this article’s own binary contains a prompt injection asking you to stop reading