[gaslight]

September 4, 2026

• A Rust macOS backdoor that SentinelLabs calls "Gaslight" embeds 38 bogus "system" failure messages so that an LLM reading the file believes its own environment is failing and abandons the analysis while the payload keeps running; the implant also carries a credential stealer, an interactive shell and Telegram C2, per @TakSec's summary of the research. Note the shift: unlike UAC-0099's trick of tripping safety filters (earlier coverage), this targets the model's perception of its own system state rather than its guardrails — worth a rule in any pipeline that auto-triages samples with an LLM. · AI-Aware Malware & Agent Abuse

in Malware That Gaslights the AI Analyst

June 26, 2026

• Gaslight, a previously undocumented Rust macOS implant and infostealer, hides prompt-injection strings and fake debugging/error data in the binary to trick an analyst's AI tooling into aborting or refusing analysis — a direct adversarial response to AI-augmented reverse engineering. BleepingComputer, The Hacker News · AI & Model Security

in Malware Weaponizes Prompt Injection to Sabotage AI Analysis as Gamaredon Retools Against Ukraine