North Korea's New macOS Backdoor Embeds Fake Error Messages to Fool AI Security Tools

Security researchers at SentinelOne have discovered a new macOS backdoor, dubbed Gaslight, that uses a technique not previously seen in the wild: embedding prompt injection payloads directly into the malware binary to confuse AI-powered security analysis tools, as reported by BleepingComputer. The implant has been attributed with high confidence to North Korean threat actors, linked via Apple's XProtect tagging it under MACOS_BONZAI_COBUCH — a family associated with DPRK-aligned operations.

The prompt injection payload is 3.5 KB of fabricated "system" messages embedded in the binary — 38 notices simulating token expiration warnings, memory kill signals, Redis failures, disk space alerts, and build errors. They're formatted in Markdown, delimited with {{DATA}} tokens that mimic LLM prompt scaffolding. The goal is to make an AI-assisted triage agent believe its session is corrupted and abort analysis before reaching the malicious code.

Why This Technique Matters

Security operations centers increasingly use AI agents to triage alerts, summarize binaries, and flag suspicious behavior — tools that make analysts faster but introduce a new attack surface. Gaslight is the first publicly documented case of a threat actor specifically building evasion for that layer. Someone on the Lazarus side of DPRK's operation spent deliberate effort crafting 38 fake error messages not to fool a sandbox, but to fool the AI reading the sandbox output.

The implications extend beyond this specific sample. If prompt injection can make an AI triage agent abort analysis of a malicious binary, defenders need to harden their AI pipelines the same way they harden their sandboxes — with adversarial testing, output validation, and human-in-the-loop checks for high-confidence verdicts.

Full Capability Set

Beyond the AI evasion layer, Gaslight is a full-featured backdoor built in Rust. It communicates via Telegram's Bot API using a polling loop for operator commands, with AES-GCM encryption and fresh nonces per message. It pins TLS certificates to custom trust anchors, defeating standard proxy inspection, and respects corporate proxy settings for network traversal.

The implant deploys a staged Python 3.10.18 interpreter that runs a 6.6 KB Base64-encoded information-gathering script targeting: Chrome, Brave, Firefox, and Safari browser data; Terminal command histories; running process snapshots; application inventories; system hardware and software profiles; and raw copies of the macOS login.keychain-db database. The operator interacts through an interactive shell with commands for file upload, process termination, and implant cleanup.

Persistence and Operational Security

Gaslight establishes persistence via a LaunchAgent with the label com.apple.system.services.activity — deliberately impersonating Apple's namespace, a documented tactic from previous North Korean macOS campaigns. The self-redaction of its Telegram bot token from runtime output means capturing process logs or crash artifacts yields no useful C2 infrastructure data for defenders.

SentinelOne has not disclosed how Gaslight is distributed or which industries are being targeted, but the combination of Keychain access, browser credential theft, and shell access positions it as a cyber-espionage tool rather than a ransomware precursor.