North Korean APT Targets macOS to Steal Crypto Wallets and SSH Keys

Gbhackers •Mayura Kathir • June 3, 2026

A newly uncovered macOS intrusion campaign attributed to the North Korean state- threat group Sapphire Sleet, also known as BlueNoroff or UNC1069, is targeting high-value organizations in the financial and cryptocurrency sectors. The operation focuses on venture capital firms, Web3 developers, and crypto platforms, highlighting a continued shift in North Korean cyber operations toward financially […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

North Korean Hackers Target macOS Users in Cryptocurrency Theft Campaign A sophisticated malware campaign targeting macOS users has been linked to North Korean threat group Sapphire Sleet. This operation focuses on cryptocurrency organizations, venture capital firms, and Web3 developers. Attackers use social engineering tactics to convince victims to download malware disguised as a legitimate Zoom update. Once installed, the malware executes a multi-stage infection chain, leveraging trusted macOS components to evade security measures. It collects sensitive information, including cryptocurrency wallets and SSH keys, and sends it to North Korean-controlled servers. The campaign signifies a shift towards trust abuse rather than traditional exploitation methods. Security researchers from LevelBlue's SpiderLabs attribute this activity to Sapphire Sleet based on familiar tactics and techniques. The campaign is ongoing, with significant implications for affected sectors. 2 sources 76

Extracted Entities

North Korean APT Targets macOS to Steal Crypto Wallets and SSH Keys

The full story

Extracted Entities

APT Groups (3)

Industries (1)

Platforms (1)