North Korea-Linked macOS Malware Uses Prompt Injection to Evade AI Analysis

SentinelOne identified macOS.Gaslight, a Rust-based macOS remote backdoor and infostealer that uniquely uses embedded fake messages to perform prompt-injection against LLM-based analysis tools; it collects browser data, Terminal history, and Keychain credentials via an embedded Python payload, persists using a LaunchAgent, and communicates with attackers through Telegram Bot API. Researchers linked the strain to North Korean actors and observed that initial samples were not detected on VirusTotal, indicating a likely early-stage, targeted operation.