Executive Summary
Gaslight, a Rust macOS stealer, embeds a prompt injection payload meant to make an analyst's AI tools abort or refuse analysis.
What Happened
A previously undocumented Rust-based macOS implant and information stealer has been found to embed a prompt injection payload designed to trick a malware analyst's artificial intelligence (AI) tools and trick it into aborting or refusing an analysis of the artifact. The malware has been codenamed Gaslight owing to this deceptive behavior. It's been assessed with high confidence that the tool is
Affected Products
- macOS
Vulnerability / Attack Technique
Prompt injection aimed at defenders' AI tools
Technical Mechanism
Text inside the malware targets AI-assisted analysis so the tool refuses or stops.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
Malware is now written to evade AI analysts. RealGround analysis: treat AI refusals during triage as a warning sign.
Recommended Controls
- Keep non-AI analysis paths for suspicious samples
Related RealGround Service
Secure AI Agent Build · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/06/new-gaslight-macos-malware-uses-prompt.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.