Back Blogs.Microsoft

Dissecting Sapphire Sleet’s macOS intrusion from lure to compromise

Blogs.Microsoft •Microsoft Threat Intelligence and Microsoft Defender Security Research Team • April 16, 2026

The Microsoft Defender Security Research Team uncovered a sophisticated macOS intrusion campaign attributed to the North Korean threat actor Sapphire Sleet that abuses user driven execution and social engineering to bypass macOS security protections and steal credentials, cryptocurrency assets, and sensitive data.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

North Korean Sapphire Sleet Targets macOS Users in New Social Engineering Campaign A North Korean cybercrime group known as Sapphire Sleet has launched a social engineering campaign targeting macOS users, as reported by Microsoft's Threat Intelligence unit. The campaign involves tricking users into executing malicious files disguised as software updates, allowing the attackers to steal credentials, cryptocurrency assets, and personal data. This shift in tactics marks a move away from exploiting software vulnerabilities to a user-initiated attack model, which bypasses macOS security features. The group has been operational since March 2020 and primarily targets the financial sector, including cryptocurrency and blockchain organizations. Microsoft has shared details of the campaign with Apple as part of its responsible disclosure process. Sapphire Sleet is believed to be linked to the notorious Lazarus Group and aims to generate revenue through the theft of crypto wallets and sensitive information. The attack method employs fake recruitment profiles to lure victims into installing malware. The campaign highlights the persistent threat posed by state-sponsored actors in the cybersecurity landscape. 6 sources 73

Extracted Entities

Dissecting Sapphire Sleet’s macOS intrusion from lure to compromise

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Platforms (1)