Hackers Use Fake Software Update Prompts to Steal Passwords and Crypto Wallet Data From macOS Users

Microsoft attributes a 2026 social-engineering campaign to North Korean group Sapphire Sleet that targets macOS users in the cryptocurrency, venture capital, and blockchain sectors by luring victims to run malicious AppleScript 'update' files; these deploy fake system update dialogs to harvest passwords, install multiple persistent backdoors (including an in-memory loader), collect wallet files, browser-stored credentials, SSH keys and other sensitive data, and exfiltrate archives to attacker servers while sending credentials via Telegram. The report includes comprehensive IoCs (IPs, domains, filenames, filepaths, tokens, and user-agents) and mitigation recommendations such as blocking downloaded AppleScript files, monitoring macOS TCC changes, and using hardware wallets.