North Korean macOS Rust backdoor fools LLM triage with fake system prompts
SentinelOne uncovered macOS.Gaslight, a Rust‑based macOS backdoor linked to North Korea that injects 38 fake system messages to sabotage LLM‑driven triage. The implant hides a credential stealer and talks to its command‑and‑control server via a Telegram Bot API, encrypting traffic with AES‑GCM over pinned TLS.