techjacksolutions.com • 2h
MacOS.Gaslight: DPRK AI-Aware Malware Using Prompt Injection for Evasion
North Korean state-sponsored actors have deployed MacOS.Gaslight, a Rust-based information stealer and backdoor targeting macOS environments. The implant utilizes a novel evasion technique by embedding 38 adversarial prompt injection strings designed to manipulate LLM-based malware triage tools. By targeting the cognitive layer of analysis, the malware attempts to trigger AI safety guards or provide fabricated system context, inducing AI assistants to misclassify the payload as benign or refuse analysis. This strategy directly degrades the accuracy of AI-assisted SOC triage, increasing attacker dwell time by blinding automated security analysis pipelines.