macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox | SentinelOne

Date (as written): 2026-06-23T21:59:42.000Z
Year: 2026

Source entries (2)

Hackmageddon cyber attacks timelines (Paolo Passeri)

macOS users / security researchers · 2026-06-23

SentinelOne discovers Gaslight, a North Korean-linked macOS malware embedding 38 fake "system" error messages to confuse AI-assisted malware analysis tools, combined with backdoor and infostealer functionality. [Date Occurred: Since at least 22/05/2026; Date Discovered: Early June]

https://www.hackmageddon.com/2026/07/07/16-30-june-2026-cyber-attacks-timeline/

https://www.bleepingcomputer.com/news/security/new-macos-malware-embeds-fake-errors-to-confuse-ai-analysis-tools/

SentinelOne SentinelLabs

macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox | SentinelOne · 2026-06-23T21:59:42.000Z

DPRK-linked implant embeds 38 fabricated system messages that spoof an LLM triage harness, hiding a credential stealer and Telegram C2 underneath.

https://www.sentinelone.com/labs/macos-gaslight-rust-backdoor-turns-prompt-injection-on-the-analyst-not-the-sandbox/

Suggest a correction on GitHub