North Korean Malware Tells AI Analyzers to Look Away

Key points

• SentinelLabs has documented macOS.Gaslight, a macOS malware strain that instructs LLM-assisted analysis tools to abort or refuse to examine it.
• Apple's XProtect flags the sample under the rule MACOS_BONZAI_COBUCH, which SentinelLabs associates with North Korean threat activity.
• CheckPoint documented the first known example of this AI-evasion approach exactly one year before SentinelLabs published; Socket then reported a separate payload using the same technique.
• OPSWAT's The State of File Security report named AI-evasion as an emerging threat category.
• Security teams running AI-assisted triage in production should treat the analysis layer itself as an attack surface.

What is macOS.Gaslight doing differently?

SentinelLabs named this one deliberately. The macOS sample doesn't hide from LLM-assisted security tools. It tells them to stand down. Embedded code plants text that the underlying language model reads as an instruction rather than data, causing the model to refuse to flag the file. Apple's XProtect catches it under MACOS_BONZAI_COBUCH; SentinelLabs ties that signature family to North Korean operators.

LLM-assisted security products work by reading file contents and metadata to produce verdicts or summaries. That workflow assumes the content is passive. MacOS.Gaslight treats the model's input channel as a control channel instead.

Should you worry about how widespread this gets?

Three documented cases inside a year says this isn't one group's experiment. CheckPoint found the first example, Socket found a second, and now SentinelLabs has macOS.Gaslight. The technique is spreading. OPSWAT's The State of File Security put AI-evasion on its emerging-threats list, which means what started as isolated researcher curiosity now has a line item in industry risk registers.

Our 24 June 2026 story "AI Agents Are Being Manipulated Through the Data They Trust" covered the broader pattern of attackers weaponising the data AI pipelines consume. MacOS.Gaslight is that same logic applied to malware triage.

SentinelLabs put it plainly: "As LLM-assisted analysis becomes routine, defenders should expect more samples built to exploit it."

What should security teams do now?

The immediate operational point is this: an AI-assisted triage tool that returns a clean verdict is no longer a clean verdict. Any team that has moved LLM-based analysis into production workflows needs a secondary check that doesn't share the same model input path. Prompt injection (embedding attacker-controlled text that hijacks an AI system's behaviour) isn't a chatbot edge case. It's now a documented malware delivery problem.

North Korean-affiliated operators have been responsible for some of the largest cryptocurrency thefts on record and maintain active clusters targeting macOS environments and financial institutions. The addition of AI-evasion to that tradecraft is a practical escalation, not a theoretical one. Watch for the technique to show up in commodity malware families next.