Back Securityaffairs.Co

macOS.Gaslight: North Korea

Securityaffairs.Co •Pierluigi Paganini • June 26, 2026

macOS.Gaslight: DPRK Rust implant for Mac with a prompt injection payload designed to fool AI-based malware analysts. SentinelLabs researchers spotted a Rust-based macOS implant, dubbed macOS.Gaslight, that surfaced in early June after an Apple XProtect update pointed to a VirusTotal sample uploaded on May 22. The binary was undetected by static engines at the time […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

DPRK-Linked macOS.Gaslight Implant Targets Analysts with Prompt Injection A new Rust-based macOS implant named macOS.Gaslight has been linked to North Korean cyber activities. This malware features a prompt injection payload aimed at misleading AI-based malware analysts. It was first detected in early June 2026, following an Apple XProtect update that flagged a VirusTotal sample uploaded on May 22. The implant is characterized by its hardened Telegram-based command-and-control channel and is ad hoc signed. Researchers from SentinelLabs confirmed its association with DPRK-linked activities, particularly those related to BONZAI and AIRPIPE signatures. The binary remains undetected by static analysis engines, raising concerns about its stealth capabilities. The malware is designed to operate on macOS systems, specifically targeting Mac users. Current assessments indicate a high confidence in its state-sponsored origins. 2 sources 70

Extracted Entities

macOS.Gaslight: North Korea

The full story

Extracted Entities

Attack Types (1)

Countries (1)

Malware (1)

Platforms (1)