Listen to this Post
Introduction
The cyber threat landscape is undergoing a seismic shift as adversaries move beyond traditional malware deployment to target the very tools defenders rely on. In June 2026, SentinelOne’s SentinelLabs uncovered three distinct but equally concerning threat campaigns: macOS.Gaslight, a North Korean Rust-based backdoor that uses prompt injection to blind AI-assisted malware analysis; PCPJack, a self-propagating cloud worm that evicts rival threat actors while harvesting credentials at scale; and a multi-actor espionage campaign leveraging established backdoors like PlugX and ShadowPad against government infrastructure. These discoveries underscore a critical reality: attackers are now weaponizing AI pipelines, cloud-1ative infrastructure, and convergent espionage tactics with unprecedented sophistication.
Learning Objectives
- Understand the technical mechanisms behind prompt injection attacks targeting LLM-assisted malware analysis pipelines
- Identify the exploitation vectors, credential harvesting techniques, and propagation methods used by the PCPJack cloud worm
- Implement defensive measures to secure AI analysis workflows, cloud infrastructure, and identity management systems
1. macOS.Gaslight: When Malware Gaslights the Analyst
The Anatomy of a Prompt Injection Attack
macOS.Gaslight is a Rust-based macOS implant and infostealer, first uploaded to VirusTotal on May 22, 2026, and later flagged by an Apple XProtect update. What makes this malware extraordinary is not its data-stealing capabilities—though it harvests Keychain data, browser passwords, and sensitive files via Telegram Bot API C2—but its embedded 3.5 KB prompt-injection payload containing 38 fabricated “system” messages.
These messages simulate fake token expiry notices, out-of-memory kills, disk exhaustion warnings, and bogus static analysis flags. The payload is structured with `{{DATA}}` tokens and Markdown fences that mimic an LLM triage harness’s own prompt scaffold, blurring the boundary between untrusted sample data and trusted instructions. The goal is simple yet devastating: trick the AI analyst into aborting, truncating, or refusing analysis before it reaches anything interesting.
Command-and-Control: Telegram Bot API with Hardened Transport
The implant’s C2 channel operates over a Telegram Bot API `getUpdates` polling loop. All payloads are encrypted with AES-GCM using a fresh nonce per message, and the implant pins its TLS certificate to a custom trust anchor—rendering standard proxy inspection ineffective. The implant also self-redacts its Telegram bot token at runtime, ensuring that even if logs or crash artifacts are captured, the token is not recoverable.
Defensive Measures for AI Analysis Pipelines
Organizations integrating LLM/AI agents into SOC triage or reverse-engineering workflows must treat untrusted binaries as hostile input. Implement input sanitization, prompt boundaries, and human-in-the-loop validation for any AI-generated analysis output.
- PCPJack: The Cloud Worm That Evicts Its Rivals
A Framework Built for Credential Theft at Scale
Discovered on April 28, 2026, PCPJack is a modular Linux- and Python-based credential theft framework that worms across exposed cloud infrastructure. Unlike typical cloud malware that deploys cryptominers, PCPJack focuses purely on credential harvesting—a strategic choice that indicates monetization through fraud, spam, extortion, or resale of stolen access.
The framework targets exposed Docker daemons, Kubernetes API servers, Redis instances, MongoDB clusters, and RayML endpoints. It exploits five known vulnerabilities for initial access: CVE-2025-29927 (Next.js middleware authentication bypass), CVE-2025-55182, CVE-2026-1357, CVE-2025-9501 (unauthenticated PHP command injection in W3 Total Cache), and CVE-2025-48703.
The Eviction Strategy: Removing TeamPCP
What gives PCPJack its name is its first action upon execution: it actively searches for and removes processes, files, containers, services, and persistence artifacts associated with the TeamPCP threat group. TeamPCP was responsible for several high-profile supply chain intrusions in early 2026, including the compromise of Aqua Security’s Trivy and the BerriAI LiteLLM gateway. Researchers assess with moderate confidence that PCPJack may be operated by a former TeamPCP member or affiliate deeply familiar with the group’s tooling.
Propagation and Credential Harvesting
PCPJack’s infection chain begins with a shell-based bootstrap component that prepares a hidden working environment, installs Python dependencies, downloads modules, establishes persistence (via systemd or cron), and then deletes itself. It harvests credentials from an extensive list of targets: environment files, SSH keys, AWS IMDS tokens, Kubernetes service account tokens, Docker secrets, and credentials for services including AWS, GitHub, Slack, Office 365, OpenAI, Anthropic, and cryptocurrency exchanges. Exfiltrated data is encrypted using X25519 ECDH and ChaCha20-Poly1305.
The framework also operates a 230-1ode covert SMTP email relay network built from compromised servers across the US, Europe, and Asia. Recovered tooling shows use of the Sliver framework for C2 and Chisel binaries for reverse SOCKS5 tunneling.
Practical Hardening Commands
Audit Exposed Cloud Services:
Scan for exposed Docker daemons nmap -p 2375,2376 --open <target_network> Check Kubernetes API exposure kubectl --insecure-skip-tls-verify get nodes Identify RayML clusters with unauthenticated dashboard nmap -p 8265 --open <target_network>
Harden Kubernetes Clusters:
Enable RBAC and disable anonymous auth kubectl edit clusterrolebinding system:anonymous Rotate service account tokens kubectl delete secret <service-account-token> kubectl create serviceaccount <name>
AWS IMDS Hardening:
Disable IMDSv1 and require IMDSv2 aws ec2 modify-instance-metadata-options \ --instance-id <instance-id> \ --http-tokens required \ --http-put-response-hop-limit 1
3. Multi-Actor Convergent Espionage: The New Normal
Simultaneous Targeting by Multiple Nation-State Actors
SentinelLabs tracked multiple distinct threat actors—with ties to different nations—simultaneously targeting government and law enforcement infrastructure. These actors utilized established backdoors including PlugX, ShadowPad, Remcos RAT, and Cobalt Strike to exploit digitized web applications and gain long-term persistence.
ShadowPad, a modular malware platform privately shared with multiple PRC-linked threat actors since 2015, is considered the successor to PlugX. The convergence of multiple threat clusters using shared or commodity tooling complicates attribution and incident response, as defenders must contend with overlapping indicators of compromise and potentially conflicting TTPs.
Defensive Recommendations
- Continuous monitoring of web application logs for unusual API calls or file uploads
- Endpoint detection and response (EDR) with behavioral analytics to identify Cobalt Strike and similar beaconing activity
- Regular vulnerability scanning of internet-facing applications, particularly those using Next.js, React Server Components, or other frameworks with known CVEs
- Secure AI Analysis Pipelines: A New Defensive Frontier
Treating Untrusted Binaries as Hostile Input
The emergence of macOS.Gaslight demonstrates that LLM-assisted malware analysis tools are vulnerable to prompt injection—not just from user inputs, but from the malware samples themselves. Defenders must implement:
- Input sanitization: Strip or escape Markdown, control characters, and prompt-like structures from binary strings before feeding them to LLMs
- Prompt hardening: Use delimiters and instruction boundaries that are resistant to injection
- Human validation: Require analyst review for any AI-generated “abort” or “refuse” recommendations
- Sandbox isolation: Run AI analysis tools in environments where their outputs cannot influence downstream systems
Verification Commands
Extract embedded strings from a Mach-O binary
strings -a <sample> | grep -E "(system|error|failure|abort)"
Check for Markdown fences or prompt-like structures
xxd <sample> | grep -i "markdown|```|{{DATA}}"
Monitor for LLM triage tool anomalies
tail -f /var/log/llm-triage.log | grep -E "(abort|refuse|truncate)"
5. Cloud Infrastructure Hardening Against PCPJack
Immediate Actions for Cloud Defenders
Given PCPJack’s exploitation of five CVEs and its worm-like propagation, organizations should:
- Patch known vulnerabilities: Apply patches for CVE-2025-29927, CVE-2025-55182, CVE-2026-1357, CVE-2025-9501, and CVE-2025-48703 immediately. Particular attention should be paid to Next.js and React Server Component-based applications.
-
Audit exposed services: Scan for unauthenticated Docker daemons (ports 2375, 2376), Kubernetes API endpoints, Redis (6379), MongoDB (27017), and RayML dashboards (8265).
-
Implement credential rotation: Automate rotation of AWS IMDS tokens, Kubernetes secrets, and SSH keys. Use short-lived credentials where possible.
-
Deploy network segmentation: Isolate container orchestration and ML compute clusters from public internet access.
Detection Commands
Check for PCPJack persistence indicators ls -la /var/tmp/.xs systemctl status xsync crontab -l | grep -i "xsync|PCP" Scan for known PCPJack IOC patterns grep -r "PCPJack|TeamPCP" /var/log/
What Undercode Say
- macOS.Gaslight represents a paradigm shift: Malware is no longer just evading sandboxes—it is actively manipulating the analysts and AI tools that study it. This adversarial AI technique will likely be adopted by other threat actors across all platforms.
-
PCPJack signals the commoditization of cloud credential theft: The active eviction of rival threat actors indicates a competitive, profit-driven ecosystem where attackers are willing to burn infrastructure to maintain exclusive access. The partnership with VECT ransomware syndicate suggests a maturation of the cybercrime economy.
-
Convergent espionage complicates attribution: When multiple nation-state actors target the same infrastructure using overlapping tooling, defenders face a attribution crisis. The focus should shift from “who” to “how”—prioritizing detection and mitigation over identification.
-
AI supply chain attacks are the next frontier: With TeamPCP’s compromise of Trivy and LiteLLM, and PCPJack’s targeting of OpenAI and Anthropic credentials, the AI supply chain is now a primary attack vector.
-
Defense must evolve: Traditional signature-based detection is insufficient. Organizations need behavioral analytics, continuous cloud posture management, and AI-1ative security tools that can detect and respond to adversarial AI techniques.
Prediction
-
+1 Prompt injection will become a standard feature of advanced malware families within 12–18 months, targeting not just macOS but Windows, Linux, and cloud-1ative environments. Security vendors will need to redesign LLM-assisted analysis pipelines with adversarial robustness in mind.
-
-1 The convergence of multiple threat actors targeting the same infrastructure will lead to “collateral damage” incidents where defenders cannot distinguish between rival groups, potentially delaying response and increasing breach impact.
-
+1 Cloud providers will accelerate the development of zero-trust architectures and automated credential rotation, reducing the attack surface for worms like PCPJack. However, the proliferation of exposed services will continue to outpace remediation efforts.
-
-1 The partnership between credential theft frameworks and ransomware syndicates (e.g., PCPJack + VECT) will create a new class of “access brokers” that monetize stolen cloud credentials at scale, leading to more frequent and devastating ransomware attacks.
-
+1 AI-powered defensive tools will emerge that can detect prompt injection and adversarial manipulation in real-time, turning the attacker’s own tactics against them. The cat-and-mouse game between AI attackers and AI defenders is just beginning.
▶️ Related Video (84% Match):
https://www.youtube.com/watch?v=-oZejviH2fQ
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Waynecissp Threat – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
