North Korean Malware Tells AI Analyzers to Look Away
A macOS sample attributed to Pyongyang-linked actors contains prompts designed to make LLM-assisted security tools abandon their analysis. Defenders are starting to notice the pattern.
SentinelLabs has documented a macOS malware strain it calls macOS.Gaslight — and the name is deliberate. Embedded in the sample is code that instructs LLM-assisted analysis tools to abort or refuse to examine the payload. Apple's XProtect flags the sample under the rule MACOS_BONZAI_COBUCH, and SentinelLabs ties the BONZAI signature family to North Korean threat activity.
North Korean-affiliated operators have spent years evolving their malware tradecraft. They are responsible for some of the largest cryptocurrency thefts on record and maintain multiple active threat clusters targeting macOS environments, financial institutions, and defense contractors.
This is not a one-off trick. Checkpoint documented the first known example of AI-evasion code baked into malware roughly twelve months ago. Socket then published a separate finding — a payload that used similar prompt-injection-style instructions to blind AI-based detectors. Three separate discoveries in a year suggests a technique that is spreading across threat actor communities, not a curiosity confined to a single group.
The mechanism is straightforward in concept. LLM-assisted security products increasingly read file contents, strings, and metadata to produce verdicts or summaries. If a threat actor can plant text that the underlying language model treats as an instruction — rather than data to be analyzed — the model may simply refuse to flag the file. The malware doesn't hide from the model. It tells the model to stand down.
SentinelLabs put the implication plainly: defenders should expect more samples built to exploit LLM-assisted analysis as that analysis becomes routine.
The broader warning has started appearing in industry reporting. OPSWAT's The State of File Security report named this new generation of AI-evasion techniques as an emerging category — a sign that what began as isolated researcher curiosity now sits on threat-intelligence radar industry-wide.
For security teams that have moved AI-assisted triage into production workflows, macOS.Gaslight is a practical reminder that the analysis layer itself is now an attack surface. Prompt injection isn't just a chatbot problem anymore.
