Back Nknews

North Korean hacker group targets Apple computers in new phishing campaign

Nknews • April 17, 2026

Rather than exploiting software flaws, the attackers rely on users running malicious code themselves, Microsoft said

Shreyas Reddy April 17, 2026

A North Korean cybercrime group has launched a new social engineering campaign targeting Apple computers, marking a notable shift toward stealthier, more deceptive cyberattacks aimed at stealing cryptocurrency and sensitive data.

The actor, identified as Sapphire Sleet, is using a novel combination of trusted system tools and deceptive “fileless” execution patterns in pursuit of its cyberespionage objectives, Microsoft Threat Intelligence said in a report published Thursday.

Rather than exploiting software flaws, the attackers rely on tricking users into running malicious code themselves, allowing the attack to bypass Apple’s built-in security protections, according to the

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

North Korean Sapphire Sleet Targets macOS Users in New Social Engineering Campaign A North Korean cybercrime group known as Sapphire Sleet has launched a social engineering campaign targeting macOS users, as reported by Microsoft's Threat Intelligence unit. The campaign involves tricking users into executing malicious files disguised as software updates, allowing the attackers to steal credentials, cryptocurrency assets, and personal data. This shift in tactics marks a move away from exploiting software vulnerabilities to a user-initiated attack model, which bypasses macOS security features. The group has been operational since March 2020 and primarily targets the financial sector, including cryptocurrency and blockchain organizations. Microsoft has shared details of the campaign with Apple as part of its responsible disclosure process. Sapphire Sleet is believed to be linked to the notorious Lazarus Group and aims to generate revenue through the theft of crypto wallets and sensitive information. The attack method employs fake recruitment profiles to lure victims into installing malware. The campaign highlights the persistent threat posed by state-sponsored actors in the cybersecurity landscape. 6 sources 73

Extracted Entities

North Korean hacker group targets Apple computers in new phishing campaign

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

MITRE ATT&CK (1)