Fake Zoom SDK Update Spreads Sapphire Sleet Malware in New macOS Attack Chain

Gbhackers •Mayura Kathir • April 17, 2026

A sophisticated macOS-focused cyber campaign orchestrated by the North Korean threat actor Sapphire Sleet, revealing a shift toward social engineering over traditional software exploitation. Instead of relying on vulnerabilities, the attackers trick users into executing malicious files disguised as legitimate software updates, effectively bypassing Apple’s built-in security protections. The campaign centers on a fake file […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Sapphire Sleet Malware Campaign Targets macOS Users via Fake Zoom SDK Update A new cyber campaign targeting macOS users has been launched by the North Korean threat actor Sapphire Sleet. The attackers are distributing malware through a fake Zoom SDK update, tricking users into executing malicious files. This attack method relies on social engineering rather than exploiting software vulnerabilities, allowing it to bypass Apple's security measures. Victims are at risk of having their passwords, cryptocurrency assets, and personal data stolen. The campaign highlights a shift in tactics from traditional software exploitation to manipulation of user behavior. Currently, there are no specific CVEs associated with this attack, and the full scope of the impact is still being assessed. Security experts are urging users to be cautious of unsolicited software updates. The campaign is ongoing, with no known resolution at this time. 2 sources 73

Extracted Entities

Fake Zoom SDK Update Spreads Sapphire Sleet Malware in New macOS Attack Chain

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

MITRE ATT&CK (1)

Platforms (1)