Beware of the new macOS malware, Gaslight.

Beware of the new macOS malware, Gaslight uses a Prompt Injection attack to fool AI on board.

According to a report by The Hacker News website, it specifically discusses the detection of a new malware aimed at attacking macOS users. A research team from SentinelOne, an expert company developing solutions for cyber protection, said that the malware was named Gaslight for deceiving its systems. The malware was designed to deceive the LLM (Large Language Model or Large Language Model) intelligence on macOS. In the Gaslight malware, fraudulent Prompt commands are embedded as misalerted messages. Missed more than 38 patterns to confuse the AI model's authentication mechanism until it malfunctioned and ultimately rejected malware file analysis. This malware is used as an intermediary to release data theft or Infostealer malware on the victim's machine. By examining the malware code, the research team found a large number of mood marks or Emoji in the comment section on the header of the code, showing that this malware was also created from LLM AI.

According to an in-depth review of the research team, the main architecture of the malware is a Bot interface API on the popular chat platform Telegram that acts as a C2 or Command and Control server, which logs in to check the Polling Loop to access intermediaries for sending commands like Interactive Shell and check the effect of using malware commands. There are 6 such commands:

Help, Enable Help (Help)

ID, used to check the malware identification number located on the victim's machine.

Shell, execute Shell commands through execvp

Kill, used to kill Process via PID

Upload, used to smuggle out files (Exfiltrate) through the "attach: / /" mechanism of the Telegram chat service.

Stop, use to suspend malware

The research team has said that the 7th expected command in the command name "focus" has also been detected, but it is not yet possible to confirm what the functionality of the command itself is; and for how to create malware persistence on the system, the malware modifies the LaunchAgent by adding "com.apple.system.services activity" to the .pist file.

The malware has also embedded Base-64 Encoding infostealer malware in a 6.6 KB Python script file. This malware has the ability to steal a lot of data, such as system data, such as local hardware and software, installed software lists, terminal command history data, database data (Database), data from many web browsers such as Chrome, Brave, Firefox, and Safari, etc. The stolen data is compressed into a file in the Zip file format (" Temp / collected_data.zip ") and then send the data to the Telegram bot.

# Trending # lemon 8 diary # macos # Gaslight # freedomhack