Gaslight: New macOS malware tries to deceive AI-based analysis systems

Cybersecurity researchers have discovered a previously unknown macOS malware that not only provides remote access to an infected device and steals data, but also contains a mechanism designed to counter artificial intelligence-driven analysis tools, The Hacker News reports.

The malware has been named Gaslight. According to SentinelOne experts, it is highly likely linked to the activities of North Korean hacking groups.

Gaslight is a Remote Access Trojan (RAT) written in Rust with info-stealer capabilities. It uses a command and control (C2) channel built on the Telegram Bot API to communicate with its operators.

Once the system is infected, the malware enters a continuous polling mode, waiting for commands from the attackers. Researchers discovered six core commands: help – displays help information; id – identifies the infected host; shell – executes shell commands via execvp; kill – terminates a process by its ID; upload – sends files using the Telegram attach:// mechanism; stop – halts the implant's operation.

Additionally, experts found signs of a seventh command—focus—though its exact purpose remains unknown.

To maintain persistence after a system reboot, Gaslight utilizes a LaunchAgent. The plist file uses the name com.apple.system.services.activity to masquerade as a legitimate macOS component.

The malware includes a Python module for gathering system information. This script, roughly 6.6 KB in size, is stored in an encoded format and extracts a wide range of data, including terminal command history, list of installed applications, information on running processes, hardware and software profiles of the computer, data from the macOS Keychain, information from Chrome, Brave, Firefox, and Safari browsers. 

The collected data is archived into a temp/collected_data.zip file and then transmitted via Telegram.

The data-stealing module itself is installed by a separate bash installer (~2 KB) that deploys the cpython-3.10.18 interpreter from the python-build-standalone project. Researchers note that numerous comments and emojis in the code may indicate the use of Large Language Models (LLMs) during its creation or modification.

Unlike many malware programs, Gaslight does not contain hardcoded control parameters. The Telegram bot token, chat ID, and other settings are passed at runtime.

Additionally, the malware hides its own Telegram token from operation logs and error messages. This approach complicates investigations, even if logs or memory dumps are retrieved from the infected device.

The defining feature of Gaslight is an embedded prompt injection mechanism targeted at analysis systems that utilize large language models.

The malware contains a Markdown block with 38 fake system messages mimicking various critical crashes. Among them are notifications about expired tokens, out-of-memory errors, disk full warnings, multiple execution errors, and alerts about alleged security issues.

According to SentinelOne researcher Phil Stokes, a notable feature of the malware is this built-in cascade of fabricated system crash messages, designed to make an LLM-powered triage agent doubt its own session. "It attacks the agent's perception rather than the sandbox it operates in," Stokes noted.

It is assumed that such messages could cause an AI tool to terminate the analysis prematurely, reduce its scope, or refuse to process the sample altogether. SentinelOne believes this is one of the first documented attempts to use prompt injection techniques against automated malware analysis processes.

The emergence of Gaslight demonstrates a shift in malware development strategies. As LLM-based tools are increasingly adopted to accelerate triage and threat analysis, threat actors are adapting their tools to exploit the unique characteristics of these systems.

In the case of Gaslight, the goal is not to bypass an antivirus or a sandbox, but to manipulate the sample analysis process itself. This could mark a new frontier in malware evolution as artificial intelligence plays a growing role in cybersecurity.

Gaslight is a new macOS malware that combines remote access and data theft capabilities with an unusual anti-analysis mechanism. The malware uses Telegram as a C2 channel, harvests a wide array of system information, and features an embedded prompt injection attack tailored against LLM-based analysis tools. Analysts believe this case may signal the arrival of a new class of threats targeting AI systems used in cybersecurity.

Follow NEWS.am Tech on Facebook and Twitter