North Korea-linked macOS malware embeds prompt injection to evade AI analysis
Researchers discovered a North Korea-linked macOS malware called Gaslight that uses prompt injection techniques to trick AI-assisted malware analysis tools into stopping their investigation. The backdoor embeds 38 fabricated system messages designed to mislead AI agents and also steals browser data and credentials using encrypted Telegram channels.
What happened
SentinelLabs discovered a North Korea-linked macOS backdoor called Gaslight that embeds prompt injection designed to mislead AI-assisted malware analysis tools. The malware contains 38 fabricated system messages formatted as Markdown to mimic the internal scaffolding of AI triage tools, including fake warnings about token expiry, memory errors, disk errors, and injection flaws.
Reported impact
The injected prompts are designed to cause AI agents to abort or refuse analysis of the malware. The underlying malware functions as an infostealer and backdoor, capable of stealing browser data from Chrome, Brave, Firefox and Safari, terminal histories, application lists, and the macOS login keychain, with command channels using Telegram's Bot API.
Index analysis
The prompt injection represents an adversarial attack on AI analysis pipelines rather than on sandbox environments. SentinelLabs noted earlier versions used a single injected block, while this sample stacks 38 into a cascade, suggesting evolving techniques since 2025.
Governance controls
SentinelLabs recommended that organizations building AI triage tools treat sample contents as adversarial input rather than instructions and isolate AI pipelines from potentially hostile content. Attribution to North Korean operators was supported partly through Apple's XProtect signature family.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.