TraderTraitor turns a Terraform lock file into a macOS backdoor dropper aimed at DevOps engineers. https://intel.threadlinqs.com/threat/TL-2026-5505?utm_source=bluesky #ThreatIntel #macOSGaslight #Contagious #TraderTraitor
November 7, 2026 at 10:38 AM
TraderTraitor turns a Terraform lock file into a macOS backdoor dropper aimed at DevOps engineers. https://intel.threadlinqs.com/threat/TL-2026-5505?utm_source=bluesky #ThreatIntel #macOSGaslight #Contagious #TraderTraitor
📌 North Korea-Linked macOS.Gaslight Malware Uses Rust and AI Deception Tactics https://www.cyberhub.blog/article/27841-north-korea-linked-macosgaslight-malware-uses-rust-and-ai-deception-tactics
North Korea-Linked macOS.Gaslight Malware Uses Rust and AI Deception Tactics
Researchers at SentinelLabs identified a Rust-based macOS implant named macOS.Gaslight, attributed to North Korea (DPRK), designed with a prompt injection payload to deceive AI-based malware analysts. The malware was first detected following an Apple XProtect update in early June 2024, referencing a VirusTotal sample uploaded on May 22, 2024, which initially evaded static detection engines. The implant leverages Rust for cross-platform compatibility and includes techniques to manipulate analysis tools. No specific CVE IDs or targeted sectors were disclosed in the report. The primary impact involves obfuscation tactics aimed at hindering automated and manual threat analysis.
www.cyberhub.blog
October 12, 2026 at 9:07 PM
📌 North Korea-Linked macOS.Gaslight Malware Uses Rust and AI Deception Tactics https://www.cyberhub.blog/article/27841-north-korea-linked-macosgaslight-malware-uses-rust-and-ai-deception-tactics
Russian Cellebrite use, a Tata Electronics leak affecting Apple and Tesla, and North Korea-linked macOS.Gaslight highlight this week’s security roundup. #Russia #TataElectronics #macOSGaslight
In Other News: Chinese Mythos-Like AI, Tata Electronics Breach, Snyk Layoffs
This week’s roundup covers a range of major cybersecurity developments, including Russian use of Cellebrite against Andrey Pivovarov, guilty pleas tied to Scattered Spider’s Transport for London breach, and a massive Tata Electronics leak affecting Apple and Tesla. It also highlights new AI-related security warnings and policy actions, alongside the emergence...
www.hendryadrian.com
June 26, 2026 at 3:45 PM
Russian Cellebrite use, a Tata Electronics leak affecting Apple and Tesla, and North Korea-linked macOS.Gaslight highlight this week’s security roundup. #Russia #TataElectronics #macOSGaslight
macOS.Gaslight is a Rust macOS backdoor tied to DPRK-aligned activity, using Telegram C2, AES-GCM, and TLS pinning. It also packs a Python stealer and prompt injection to confuse LLM-based triage. #macOSGaslight #DPRK #AppleXProtect
macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox
SentinelLABS analyzed macOS.Gaslight, a Rust macOS implant tied to DPRK-aligned activity that combines Telegram-based command and control, AES-GCM encryption, certificate-pinned TLS, and a bundled Python stealer. The sample also includes a 3.5 KB prompt-injection payload with 38 fabricated system messages designed to derail LLM-assisted triage and hide its malicious behavior. #macOSGaslight #BONZAI #AIRPIPE #Telegram #AppleXProtect
www.hendryadrian.com
June 24, 2026 at 12:15 PM
macOS.Gaslight is a Rust macOS backdoor tied to DPRK-aligned activity, using Telegram C2, AES-GCM, and TLS pinning. It also packs a Python stealer and prompt injection to confuse LLM-based triage. #macOSGaslight #DPRK #AppleXProtect
macOSGaslight: The Rust Backdoor That’s Gaslighting AI Malware Analysts with Prompt Injection + Video
Introduction A newly discovered macOS malware family, tracked as macOS.Gaslight, has introduced a paradigm shift in evasion tradecraft by weaponizing prompt injection not against sandboxes, but…
Introduction A newly discovered macOS malware family, tracked as macOS.Gaslight, has introduced a paradigm shift in evasion tradecraft by weaponizing prompt injection not against sandboxes, but…
macOSGaslight: The Rust Backdoor That’s Gaslighting AI Malware Analysts with Prompt Injection + Video
Introduction A newly discovered macOS malware family, tracked as macOS.Gaslight, has introduced a paradigm shift in evasion tradecraft by weaponizing prompt injection not against sandboxes, but against the very AI tools security analysts rely on for triage. Discovered in early June 2025 after an Apple XProtect update surfaced a Mach-O sample uploaded to VirusTotal on May 22, this Rust-based backdoor and infostealer embeds a 3.5 KB payload of 38 fabricated “system” messages designed to trick LLM-assisted analysis pipelines into aborting or refusing examination.
undercodetesting.com
June 25, 2026 at 12:36 PM
macOSGaslight: The Rust Backdoor That’s Gaslighting AI Malware Analysts with Prompt Injection + Video
Introduction A newly discovered macOS malware family, tracked as macOS.Gaslight, has introduced a paradigm shift in evasion tradecraft by weaponizing prompt injection not against sandboxes, but…
Introduction A newly discovered macOS malware family, tracked as macOS.Gaslight, has introduced a paradigm shift in evasion tradecraft by weaponizing prompt injection not against sandboxes, but…