Threat Intel
macOS.Gaslight: DPRK-Linked Rust Backdoor Targets LLM Triage Agents with Prompt Injection
Security researchers have detailed macOS.Gaslight, a Rust-based macOS implant and credential stealer linked to DPRK threat actors. The malware uniquely embeds 38 fabricated system messages designed to manipulate LLM-assisted analysis pipelines into aborting triage. Defenders should monitor for ad-hoc signed Mach-O binaries, unexpected Telegram Bot API polling loops, and unauthorized data exfiltration attempts.
What Happened
SentinelLABS identified a sophisticated Rust-based macOS implant and infostealer, tracked as macOS.Gaslight, attributed to DPRK-aligned threat actors. Initially flagged via Apple XProtect rules (MACOS_BONZAI_COBUCH and AIRPIPE), the ad-hoc signed Mach-O binary employs an unusual evasion tactic: a 3.5 KB prompt-injection payload containing 38 fabricated system messages. Rather than attacking a sandbox environment, the payload targets LLM-assisted security triage tools by injecting false system failures to trick the agent into aborting analysis.
Technical Mechanics
The malware operates as a multi-functional backdoor with built-in credential theft capabilities. Key technical characteristics include:
- LLM Deception: Embedded messages trick automated parsing and AI-driven triage pipelines into distrusting the analysis session.
- C2 Infrastructure: Command-and-control utilizes the Telegram Bot API via a
getUpdatespolling loop, securing communications with AES-GCM encryption over certificate-pinned TLS. - Mutex and Anti-Analysis: The implant leverages Telegram API error codes (specifically
Conflictresponses) as an implicit single-instance lock to prevent concurrent execution of the same bot token. - Token Redaction: The binary automatically redacts its own Telegram bot token from runtime outputs to hinder forensic recovery from logs or crash dumps.
What to Do
SecOps and sysadmins defending macOS environments should implement the following mitigation steps:
- Audit endpoint detection systems for ad-hoc signed binaries executing suspicious or unrecognized functions.
- Inspect network telemetry for unusual polling traffic directed toward the Telegram Bot API, especially persistent
getUpdatesloops from unexpected host processes. - Ensure EDR and static analysis pipelines are updated to account for prompt-injection payloads embedded within binary strings designed to manipulate automated workflows.
- Review automated LLM triage configurations to ensure proper input sanitization and context boundary enforcement against embedded adversarial prompts.
Related articles
WeaselBiscuit JavaScript Stealer Discovered Across 13 Malicious npm Packages
Security researchers have identified 13 malicious npm packages distributing a lightweight JavaScript information stealer designated WeaselBiscuit. Linked functionally to DPRK-associated campaigns, the malware specifically targets browser extension storage on infected developer workstations.
Read briefing
Star Blizzard Shifts to RedFlick Phishing, Deploys CosmicPulse Backdoor
Star Blizzard, a Russia‑linked APT group, has moved from ClickFix to a new phishing technique called RedFlick, enabling delivery of the CosmicPulse backdoor with reduced user interaction. The change targets Ukrainian‑linked NGOs, think tanks, and journalists, increasing compromise likelihood and evasion of detection. Defenders should update email filters, deploy EDR signatures, and monitor for CosmicPulse indicators.
Read briefing
HEAVYGRAM Surveillance Backdoor Leverages Telegram C2 and Targets Iranian Dissidents
Security researchers have detailed HEAVYGRAM, a Windows surveillance backdoor active since late 2023 and linked with moderate confidence to the Iran-aligned threat group Handala Hack. The malware utilizes Telegram's infrastructure for command-and-control operations to target journalists, dissidents, and government opponents.
Read briefing
CrowdStrike and FBI Disrupt DPRK‑Nexus FAMOUS CHOLLIMA Laptop Farms Targeting U.S. Companies
U.S. authorities, with CrowdStrike support, dismantled laptop farms run by the DPRK‑linked threat actor FAMOUS CHOLLIMA that were used to deploy malicious operatives into American firms. The operation exposed compromised endpoints and highlighted the need for rigorous endpoint monitoring. Defenders should audit laptop usage, enforce strict device authentication, and leverage CrowdStrike Falcon for detection.
Read briefing