North Korea Uses ClickFix to Target macOS Users' Data

Microsoft describes an active macOS-focused ClickFix campaign attributed to North Korean APT 'Sapphire Sleet' that lures targets with fake recruiter interviews and a malicious "Zoom SDK Update.scpt" AppleScript. The attacker chain executes multiple AppleScript payloads to orchestrate beaconing, harvest credentials, steal cryptocurrency wallets and browser data, install persistent backdoors, bypass Apple's TCC security controls, and exfiltrate sensitive data; Microsoft provided mitigations and IoCs and reported the activity to Apple.