Microsoft Threat Intelligence has reported a macOS-focused campaign attributed to the North Korean state- actor Sapphire Sleet. The operation relies on social engineering to persuade targets to run malicious AppleScript files presented as a legitimate Zoom SDK update. Once executed, the script retrieves additional payloads through curl and osascript , expanding the intrusion in multiple stages. The malware is designed to steal credentials, cryptocurrency wallet data, and other sensitive information while also bypassing native macOS security protections to remain active on compromised systems.
The investigation outlines a multi-stage infection chain that begins with a .scpt lure file and continues through a sequence of curl -to- osascript payload downloads. Researchers identified several backdoor components, including com.apple.cli , a services binary, icloudz , and com.google.chromes.updaters . The threat actors were also observed tampering with the macOS TCC database to obtain AppleEvents permissions, using reflective code loading techniques, and establishing persistence through a launch daemon. Exfiltration activity relied on custom user-agent strings and communications through the Telegram Bot API.
Apple has already released Safe Browsing and XProtect updates to disrupt the campaign’s infrastructure and malware components. Microsoft recommends blocking execution of .scpt files, restricting unsafe curl pipelines, monitoring for unauthorized TCC database changes, and auditing launch daemon installations for suspicious entries. Users should also be warned unsolicited software update prompts and advised not to provide credentials through unexpected dialogs or scripts.
Defenders should detect malicious AppleScript execution, abnormal curl user-agent strings, and outbound connections to known command-and-control domains. Any identified binaries and launch daemons should be quarantined or removed immediately, followed by credential resets for affected users and validation of TCC database integrity. Incident responders should also perform forensic analysis on collected system artifacts and restore impacted data from clean backups wherever necessary.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.
Attack Narrative & Commands: An adversary has obtained a malicious PowerShell‑style script hosted on a remote server. To avoid creating a standalone binary, they leverage the native AppleScript interpreter ( osascript ) and pipe a curl download directly into the interpreter, achieving a “download‑and‑execute” in one command. This matches the rule’s osascript + curl pattern.
The command line contains both osascript and curl , so the Sigma rule’s condition ( selection_osascript and selection_curl ) evaluates to true.
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
