North Korea targets macOS users in latest heist

Sapphire Sleet, an offshoot of the Lazarus Group, is running a targeted social‑engineering campaign against finance professionals that lures victims with fake recruiter messages and a malicious macOS "Zoom SDK Update.scpt" AppleScript. The script hides malicious logic beneath decoy content and uses staged curl commands to load additional AppleScript payloads that deploy backdoors (e.g., icloudz), a credential stealer that drops systemupdate.app, and other tools to bypass macOS protections and exfiltrate wallets, credentials and sensitive files via Telegram and C2 infrastructure; Microsoft disclosed the campaign and Apple deployed platform mitigations.