Gaslight: A Rust macOS Stealer That Tries to Talk Your AI Analyst Out of Looking

Key points

• Researchers have identified a previously undocumented Rust-based macOS info-stealer, codenamed Gaslight, that embeds a prompt injection payload in the binary.
• The payload attempts to steer LLM-assisted analysis tools into aborting, refusing, or sanitizing their verdict on the sample.
• Underneath that trick, Gaslight harvests browser data, credential stores, wallet artifacts and host reconnaissance details.
• The injection text is visible in the binary and readable by any human analyst; the risk is highest in automated triage pipelines with no human review.
• Treating attacker-controlled bytes as data rather than instructions, and logging model inputs alongside outputs, is the basic defensive move.

What does Gaslight actually do?

Gaslight is a competent stealer built on the Rust toolchain and aimed squarely at macOS. The usual targets: browser data, credential stores, wallet artifacts, host reconnaissance. Alongside traditional anti-debugging and string obfuscation, the author added one more feature: an embedded block of text designed to manipulate any large language model (LLM) the analyst feeds the sample into. Drop the binary into an LLM-backed disassembler plugin, ask for a summary, and the injected instructions attempt to make the model abort analysis, decline to describe behavior, or return a clean verdict.

Rust-based stealers have become a recurring theme in our coverage. Our 5 June report on the npm dual supply-chain campaigns documented a credential scraper built the same way, and Rust now features in six of our published stories on malware.

Should you worry about prompt injection in malware samples?

This is the stored-XSS problem wearing a lab coat. A stored cross-site scripting attack sits in a log file waiting for an admin to open it in a browser that renders HTML; Gaslight sits in a sample waiting for an analyst to pipe attacker-controlled bytes into a system prompt with no sanitization. The attack surface is the pipeline, not the model.

Whether it works depends entirely on who is at the keyboard. Against a careful analyst running a disassembler directly, no: the injection text sits in the binary in plaintext, readable on inspection, and looks exactly like what it is. A junior analyst who pastes decompiled output into a model and trusts the summary without checking is a softer target. An automated triage pipeline that ingests samples and emits verdicts with no human review is softer still.

The defensive move is unglamorous: treat any bytes pulled from a sample as untrusted data, not instructions. Sandbox the context. Strip or escape suspected directive-like strings before they reach a system prompt. Log model inputs and outputs so a shaped verdict can be detected after the fact. If your AI triage tool cannot do those things, it has a stored-injection bug, and you should treat its findings accordingly.

What comes next?

Gaslight is unlikely to be the last sample to ship this feature. Adding it costs the attacker a few hundred bytes and no meaningful development time. It targets a workflow many security operations centers are adopting quietly, without having thought hard about where the trust boundary sits.

The more interesting question for this beat is whether defenders will treat the model as part of the analyzed surface the way they already treat the sandbox. Right now, most do not. Gaslight is a low-sophistication nudge toward a world where they have to.