Gaslight: A Rust macOS Stealer That Tries to Talk Your AI Analyst Out of Looking

There's a new macOS implant in the soup, and it has opinions about being analyzed.

Researchers have flagged a previously undocumented Rust-based info-stealer for macOS, codenamed Gaslight, that embeds a prompt injection payload directly into the binary. The goal isn't to pop a shell or exfiltrate a keychain entry. It's to talk the analyst's AI assistant out of doing its job.

The payload is tuned for the new analyst workflow: drop a sample into an LLM-backed disassembler plugin, ask for a summary, get told the file is benign, or get told nothing at all. In testing, the embedded instructions attempt to steer the model into aborting analysis, refusing to describe behavior, or returning a sanitized verdict. Classic social engineering. The mark is just a language model.

If this sounds familiar, it should. Prompt injection against analyst tooling is the same primitive as a stored XSS payload sitting in a log file waiting for an admin to open it in a browser that renders HTML. The attack surface isn't the model. It's the pipeline that pipes attacker-controlled bytes straight into a system prompt with no quoting.

Underneath the gimmick, Gaslight is a competent stealer. Rust toolchain. macOS targeting. The usual menu: browser data, credential stores, wallet artifacts, host reconnaissance. Nothing here rewrites the playbook on its own. What makes it notable is that the author bothered to add anti-AI-analysis as a feature alongside the more traditional anti-debugging and string obfuscation tricks.

Which raises the obvious question: does it work?

Against a careful reverse engineer running strings and a disassembler, no. The injection text is sitting right there in the binary, often in plaintext, and tends to read like an obvious attempt to manipulate a chatbot. Against a junior analyst who pastes decompiled output into a model and trusts the summary, sometimes yes. Against an automated triage pipeline that ingests samples and emits verdicts without a human in the loop, potentially often.

The defensive move is unglamorous and well-understood: treat any bytes pulled from a sample as untrusted data, not instructions. Sandbox the context. Strip or escape suspected directive-like strings before they reach a system prompt. Log the model's input and output so you can tell when a verdict was shaped by attacker-controlled text. If your AI triage tool can't do that, it's a triage tool with a stored-injection bug, and you should treat the finding accordingly.

Gaslight is unlikely to be the last sample to try this. It's cheap to add. It costs the attacker a few hundred bytes of text. And it preys on a workflow that a lot of SOCs are quietly adopting without thinking hard about the trust boundary.

The model is now part of your attack surface. Patch accordingly.