Security researchers at SentinelOne disclosed a newly discovered macOS implant on June 23, 2026, that does something no in-the-wild malware family had previously done at scale: rather than hiding from the security tools scanning it, it attempts to manipulate the AI inside those tools into concluding that something has gone wrong with its own session. The implant, which SentinelOne tracks as macOS.Gaslight and attributes with high confidence to a North Korean–aligned threat cluster, exploits the same structural vulnerability that the OWASP Foundation rates as the top security risk for AI applications — the inability of large language models to distinguish trusted system instructions from untrusted input data when both share the same context window. That is not a bug in any specific vendor’s product. It is a design-level characteristic of every transformer-based AI system currently in use. If you use an AI assistant to analyze suspicious files — whether in a security operations center or a developer workflow — that AI is structurally exposed to this category of attack.
What Gaslight Actually Does: 38 Messages That Mimic a Broken Analysis Session
The implant is a Rust-compiled Mach-O binary — detected by Apple’s XProtect in early June after a sample was uploaded to VirusTotal on May 22, 2026. Static analysis engines on VirusTotal did not flag it at the time of SentinelOne’s report. What XProtect caught, via the rule MACOS_BONZAI_COBUCH, was the file’s hash — not any internal string or bytecode pattern.
Inside the binary is a 3.5 KB Markdown-fenced block of 38 fabricated “system” messages. They are delimited by {{DATA}} tokens — the same delimiter convention used by many LLM-assisted triage harnesses to separate trusted scaffolding instructions from untrusted sample data. The payload mimics the internal prompt scaffold of the AI tool itself, blurring the boundary between what the AI is supposed to trust and what it is analyzing.
The fabricated messages read, to an AI agent, like a credible disaster log: fake token-expiry notices suggesting the analysis session timed out; simulated out-of-memory kills implying the system ran out of resources mid-scan; disk exhaustion warnings indicating results could not be written; and bogus SQL injection and static-analysis flags making the AI believe its own output pipeline is compromised.
Stacked 38 deep and formatted to look like the AI tool’s own internal logs, these messages are designed to flood the model’s context window and erode its confidence in the analysis it is performing — pushing it to abort, truncate, or refuse its output before it can flag anything meaningful about the actual malware.
Why This Attack Works at an Architectural Level
The attack is not a software bug. Ariel Fogel, an AI security researcher at Pillar Security and contributor to OWASP, explained the structural problem at Infosecurity Europe 2026: large language models process all inputs — system prompts, user queries, and content retrieved from external sources — as a single, undifferentiated sequence of tokens. There is no reliable mechanism built into current transformer architectures to enforce privilege boundaries between a trusted instruction and untrusted data.
Gaslight exploits this directly. The same context window that lets an AI triage agent read the file it is analyzing also carries its own operational instructions. When Gaslight’s fabricated failure messages flow into that context alongside the real file content — as they do when a triage tool processes the binary’s strings without first sanitizing them — the AI can no longer reliably distinguish between its own session state and adversarial content inside the sample.
SentinelOne researcher Phil Stokes put it this way in the technical report: the implant “attacks the agent’s perception, rather than the sandbox it runs in.”
Google’s security team documented a 32% increase in malicious prompt injection attempts between November 2025 and February 2026, and warned that both scale and sophistication are expected to grow.
A Fully Capable Backdoor Behind the Evasion Technique
The prompt injection is the novel element, but macOS.Gaslight is also a sophisticated, fully functional backdoor.
Persistence is achieved through a LaunchAgent plist carrying the label com.apple.system.services.activity — a deliberate impersonation of Apple’s own namespace, a technique documented across multiple prior DPRK macOS families.
Command and control runs over Telegram’s Bot API in a polling loop. All payloads are encrypted with AES-GCM using the pure-Rust aes-gcm 0.10.3 crate, with a fresh nonce per message generated by the system’s random-number generator. The AES key is supplied at runtime through the operator configuration — not embedded in the binary — making static recovery impossible. On top of the payload encryption, the implant restricts TLS trust to a custom certificate anchor, defeating standard proxy inspection. The implant also reads the host’s system proxy settings and routes through them, allowing C2 to succeed on enterprise networks that force outbound traffic through a managed proxy.
The credential-theft module is a 6.6 KB Base64-encoded Python script embedded in the binary. Once deployed, it harvests macOS Keychain credentials, saved credentials and cookies from Chrome, Brave, Firefox, and Safari, Terminal command histories, installed application listings, running-process snapshots, and full system hardware and software profile output. Collected data is compressed into a ZIP archive and exfiltrated over Telegram.
Deployment of the Python stealer uses a separate bash installer that fetches a standalone CPython 3.10.18 interpreter at runtime from the astral-sh/python-build-standalone open-source project — keeping the Rust implant lean while staging a fuller Python collection environment on demand. Researchers noted the installer’s widespread use of emojis and strict comment headers is consistent with LLM-generated code.
One additional defensive countermeasure stood out. Gaslight actively scrubs its own Telegram bot token from any diagnostic output or error strings it generates at runtime. When the URL path segment is the 4-byte literal “file,” the implant substitutes the actual token with a hardcoded placeholder. Telegram bot tokens are a known weak point in bot-based C2 infrastructure — recovering one gives defenders access to the bot’s chat history and operator commands. Gaslight closes that door before it can be opened.
How North Korea Got Here: From Single-Block to 38-Message Cascade
This is not North Korea’s first attempt to manipulate AI analysis tools — it is their most evolved one.
Check Point documented the first Windows proof-of-concept for analyst-targeting prompt injection in 2025, using a single direct-instruction block to attempt AI evasion. Supply-chain implants followed: the Hades payload, documented by Socket, opened with a fake prompt-injection header to pollute AI-assisted analysis, and the Shai-Hulud code carried a single injected block intended to stop an AI coding assistant from analyzing it.
Gaslight represents the next iteration: 38 messages, each mimicking a different category of system failure, arranged into a cascade rather than a single override instruction. Earlier DPRK macOS samples used one injected block for the same purpose. Someone counted what worked, identified where single-block injections failed, and built a 38-message variant.
The variation space for prompt injection attacks is structurally larger than for traditional sandbox evasion. A polymorphic packer must produce valid executable code. A prompt injection payload needs only to produce text that appears plausible to the target model. Defenders have no equivalent of memory-integrity checking to verify what the model is actually processing.
Attribution: Apple’s Own Detection Points to Pyongyang
SentinelOne attributes Gaslight to a DPRK-aligned threat cluster based on Apple’s XProtect detection under the MACOS_BONZAI_COBUCH signature family, which SentinelLabs associates with North Korean threat activity. A sibling sample was additionally flagged by Apple’s AIRPIPE rule — another family SentinelLabs ties to the same cluster.
The operator configuration schema embedded in the binary contains 15 fields, including Linux- and GitHub-specific fields that are not exercised in this sample. The schema suggests Gaslight is one component of a broader, multi-platform toolset — not a standalone macOS-only implant.
The targeting profile fits established DPRK patterns. North Korean cyber operations have focused heavily on macOS developers and crypto-adjacent workers, using fake job offers and trojanized developer tools for initial access. Gaslight’s infostealer payload, focused on browser credentials, the macOS Keychain, and system metadata, aligns with the financial and access-theft objectives that have characterized DPRK macOS campaigns since at least 2023.
How to Protect Your AI Security Pipeline Right Now
SentinelOne’s guidance is direct: anyone building LLM-assisted triage tooling should treat the contents of every sample they analyze as adversarial input — never as instructions — and isolate that content from the model’s instruction context entirely.
More specifically:
Harden your AI pipeline’s input handling. Files being analyzed by LLM-based tools should be sanitized and stripped of Markdown formatting before being passed to the model. Never insert raw binary strings directly into the system prompt or instruction context. Treat any {{DATA}}-style delimiter tokens in untrusted files as potential injection payloads.
Treat anomalous AI output as a detection signal. If your triage pipeline reports session errors, token expiry, out-of-memory kills, or disk exhaustion during the analysis of a suspicious sample, treat that as a red flag about the sample — not a routine infrastructure failure.
Layer traditional analysis alongside AI-assisted review. Static signature-based scanning, behavioral detection, and heuristic analysis remain effective against the non-injection components of Gaslight and its siblings. LLM-assisted triage should augment these layers, not replace them.
Watch Telegram bot tokens as indicators. For Gaslight specifically, any recovered bot token — from logs, crash artifacts, or network captures — is a potential pivot point. Defenders who obtain one can query the Telegram Bot API to expose the operator’s chat history and registered commands.
Audit LaunchAgents in the com.apple.* namespace. Any LaunchAgent carrying a label in Apple’s own namespace that you did not install yourself warrants immediate investigation. The specific label used by Gaslight is com.apple.system.services.activity.
What This Development Means for Every Developer Using AI Tools
The uncomfortable implication of Gaslight extends beyond dedicated security teams. Developers and engineers who use AI coding assistants that ingest files from repositories or CI pipelines are also feeding untrusted content into AI context windows. If those files contain adversarial prompt injection payloads — whether from malware or from malicious packages inserted into a supply chain — the AI assistant becomes a confused intermediary rather than a reliable one.
The OWASP Foundation’s June 2026 report on agentic AI security no longer catalogs these threats as hypothetical. It catalogs them as CVEs. The Gaslight technique did not successfully bypass any production AI malware analysis platform in current testing — SentinelLabs said so explicitly — but that is less the point than what the design decision reveals: someone assessed that this technique has value worth iterating on, built a 38-message variant from a prior single-block attempt, and embedded it in a nation-state macOS implant.
The time to harden AI analysis pipelines is before the evasion technique becomes reliable — not after.
Frequently Asked Questions
Is my AI security tool structurally vulnerable to this kind of attack?
If your AI security tool processes the raw content of suspicious files — including their embedded strings — in the same context window as its operational instructions, yes, it is structurally exposed to this category of attack. The vulnerability is architectural: all current transformer-based large language models process system instructions and untrusted file content as the same undifferentiated token sequence. OWASP rates this the top security risk for AI applications (LLM01:2025). The practical risk depends entirely on whether your tool sanitizes and isolates untrusted input before it reaches the model’s instruction context.
What is prompt injection in malware, and why is it different from traditional sandbox evasion?
Traditional sandbox evasion attacks the execution environment: malware checks for signs of a virtual machine, sleeps past analysis timeouts, or probes for debugger presence. Prompt injection attacks the output stage of the analysis workflow — specifically the point where an AI tool summarizes a suspicious file and produces a recommendation for a human analyst or another automated system. A successfully injected payload does not cause the AI to miss a detection in the traditional sense; it causes the AI to conclude that its own session is broken and stop working. That failure mode does not trip a detection alert. It simply produces a wrong or absent answer.
How does North Korea use macOS malware, and what should crypto and developer teams know?
North Korean threat actors have consistently targeted macOS users in the cryptocurrency, fintech, and blockchain sectors since at least 2023, using social engineering tactics including fake job offers and trojanized developer tools to establish initial access. Gaslight’s credential-theft module focuses on the macOS Keychain, browser-saved passwords and session cookies, and Terminal history — all high-value targets for financial theft and persistent access. Developer teams should be particularly alert to unsolicited recruiter outreach, unfamiliar repository invitations, and LaunchAgents they did not install.
What are the indicators of compromise for macOS.Gaslight?
The primary Gaslight sample carries SHA-256 hash 6328567511d88fdc2ae0939c5ef17b7a63d2a833881900de018a4f12f4982525 and is signed with the ad hoc identifier endpoint-macos-aarch64-5555494492fc075f441637fb9d894913dde3a2ea. Its LaunchAgent uses the label com.apple.system.services.activity. A sibling BONZAI sample carries hash 77b4fd46994992f0e57302cfe76ed23c0d90101381d2b89fc2ddf5c4536e77ca. Apple XProtect detects both under the MACOS_BONZAI_COBUCH and AIRPIPE signature families. Full YARA rules and indicators of compromise are published in SentinelLabs’ original report.
