North Korean Hackers Target macOS Users in Cryptocurrency Theft Campaign

A North Korean-linked APT named Sapphire Sleet is running an active, multi-stage macOS malware campaign targeting cryptocurrency firms, VCs, and Web3 developers by luring victims with a fake Zoom SDK update delivered via Telegram, email, or professional platforms; the malware abuses AppleScript and native macOS components to persist, evade detection, and exfiltrate cryptocurrency wallets, SSH keys, browser extension data and other sensitive information to attacker-controlled servers.