Gaslight Stealer Embeds Fake System Messages to Mislead AI Malware Analysts

A new macOS stealer, tracked as Gaslight and attributed to North Korean operators, demonstrates a worrying evolution in malware design: deliberate prompt-injection to mislead AI-driven security tools.

Gaslight arrives as a standalone Mach-O executable commonly luring macOS users with faux meeting software, fake job recruitment materials, blockchain or gaming downloads, and developer test packages social-engineering tactics long favored by DPRK-linked groups that target Web3, crypto, gaming communities, and Mac developers.

While this sample does not appear to actively exfiltrate crypto-wallet keys or browser extensions, it harvests a wide range of sensitive artifacts: browser data from Chrome, Brave, Firefox and Safari; Terminal command histories.

A list of installed applications; running process snapshots; system_profiler output; and a copy of login.keychain-db (encrypted keychain blobs).

The backdoor component provides remote command execution and the ability to drop additional payloads.

The campaign’s standout innovation is its use of static, embedded plaintext designed to mimic AI agent triage output. Researchers found 38 fabricated “system” messages arranged to resemble the scanning data format consumed by AI-based security agents.

Messages such as “token logic seems flaky,” “excessive logging… filling up disk space,” and “connection timeout” are intended to confuse or suppress cautious decisions by automated systems that either analyze files locally or send file data to cloud-based AI services.

This form of prompt injection targets the human-like parsing and context-assessment behaviors of AI defenders rather than exploiting software bugs effectively trying to manipulate judgment at the analysis layer.

First observed in early June and flagged by Apple’s XProtect after a SentinelOne analysis, Gaslight is a compact Rust-built backdoor and stealer that blends tried-and-tested data theft with a novel attempt to “gaslight” automated triage systems.

Gaslight Stealer Embeds Fake System

Gaslight’s architecture is lightweight yet modular. It uses Serde for configuration loading, embeds a base64-encoded Python stealer (around 6.6 KB) responsible for zipping and staging stolen data, and fetches a tiny bash installer remotely to run that script.

Exfiltration and command-and-control rely on a hardened Telegram bot API channel: communications are AES-GCM encrypted with the runtime-provided key, the bot enforces a custom certificate to resist proxy-based inspection, supports proxy use common in enterprise environments, and self-redacts its bot token to frustrate researchers.

These design choices make network inspection and incident response more difficult in tightly managed enterprise networks.

Detection has progressed by late June VirusTotal showed multiple vendors flagging the sample and Apple pushed an XProtect rule to block it but attackers can and will iterate to evade signatures.

The campaign echoes earlier Rust-based macOS infostealers such as Realist/Realistic and other DPRK campaigns that have employed fake video meeting invites or malicious PDFs to compromise Macs.

The reuse of Rust aligns with a broader trend among advanced threat actors favoring memory-safe languages to reduce errors while retaining powerful functionality.

Defenders should treat Gaslight as both a data-stealer and a proof-of-concept for AI-targeted manipulation. Preventive measures remain the most effective: cautious handling of unsolicited downloads and recruiter messages, strict macOS execution policies, network egress controls, and layered endpoint protections that combine behavioral detection with updated signature feeds.

Organizations using AI-assisted security should validate agent outputs and consider combining automated triage with human review for high-risk samples.

For individuals, keeping macOS and XProtect up to date and using reputable endpoint protection plus skepticism toward lures promising jobs, crypto gains, or developer tasks will reduce exposure to Gaslight and its likely successors.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.