North Korean Malware 'Gaslight' Uses Fake Errors to Fool AI Analysis Tools

Executive Briefing

• Researchers discovered macOS malware embedding 38 fake system messages to confuse AI-assisted malware analysis pipelines
• Attributed with high confidence to a North Korean threat actor, the Rust binary carries backdoor and info-stealing capabilities
• Embedded strings mimic crash reports, memory dumps, and SQL alerts to make LLMs doubt their own analysis session
• Technique targets AI agent perception rather than sandbox environments, marking a novel anti-analysis approach
• SentinelOne notes threat actors are actively experimenting with prompt injection as an AI-specific evasion strategy