Back Scworld

New Sapphire Sleet attack against macOS users detailed | brief

Scworld • April 17, 2026

The Register reports that North Korean hacking operation Sapphire Sleet , also known as APT38, has sought to compromise macOS users with credential- and cryptocurrency-stealing payloads as part of a new social engineering attack campaign.

Fake recruiter profiles on and other social networking sites have been leveraged by Sapphire Sleet to deliver a counterfeit Zoom support meeting invitation, which lures recipients into downloading the seemingly legitimate "Zoom SDK Update.scpt" file, which injects thousands of blank lines to conceal illicit activity, according to a Microsoft analysis. After deploying a command invoking the legitimate macOS softwareupdate binary with an invalid parameter, the script proceeds to use curl to run a malicious payload retrieving another attacker-controlled script that ensures the execution of increasingly complex payloads.

Aside from deploying a credential stealer that exfiltrates data via Telegram Bot API, the campaign also involved the icloudz backdoor that enabled further in-memory delivery of additional payloads. Apple was noted to have adopted additional "platform-level protections" against the campaign after being informed by Microsoft.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

North Korean Sapphire Sleet Targets macOS Users in New Social Engineering Campaign A North Korean cybercrime group known as Sapphire Sleet has launched a social engineering campaign targeting macOS users, as reported by Microsoft's Threat Intelligence unit. The campaign involves tricking users into executing malicious files disguised as software updates, allowing the attackers to steal credentials, cryptocurrency assets, and personal data. This shift in tactics marks a move away from exploiting software vulnerabilities to a user-initiated attack model, which bypasses macOS security features. The group has been operational since March 2020 and primarily targets the financial sector, including cryptocurrency and blockchain organizations. Microsoft has shared details of the campaign with Apple as part of its responsible disclosure process. Sapphire Sleet is believed to be linked to the notorious Lazarus Group and aims to generate revenue through the theft of crypto wallets and sensitive information. The attack method employs fake recruitment profiles to lure victims into installing malware. The campaign highlights the persistent threat posed by state-sponsored actors in the cybersecurity landscape. 6 sources 73

Extracted Entities

New Sapphire Sleet attack against macOS users detailed | brief

The full story

Extracted Entities

APT Groups (2)

Attack Types (2)

Companies (1)

Malware (1)

MITRE ATT&CK (3)

Platforms (2)

Tools (2)