Sapphire Sleet Targets macOS Users In New Social Engineering Campaign, Microsoft Warns

Microsoft attributes a macOS social-engineering campaign to North Korea’s Sapphire Sleet, where victims were tricked into running a malicious AppleScript disguised as a Zoom SDK update; the script leveraged Script Editor and TCC database manipulation to bypass Gatekeeper and other protections and exfiltrate cryptocurrency wallets, browser credentials, keychain items, SSH keys, and other sensitive files. Apple added Safari Safe Browsing and XProtect signatures to block the infrastructure, while Microsoft recommended user training, inspection of .scpt files and curl-to-interpreter chains, monitoring for TCC tampering and suspicious LaunchDaemon entries, and protecting browser credential stores and crypto wallets.