North Korean Hackers Target macOS Users in Cryptocurrency Theft Campaign

• •North Korean group Sapphire Sleet targets macOS users in a new malware campaign.
• •Attackers use social engineering to distribute malware disguised as a Zoom update.
• •The malware collects sensitive data, including cryptocurrency wallets and SSH keys.

A sophisticated malware campaign targeting macOS users has been linked to North Korean threat group Sapphire Sleet. This operation focuses on cryptocurrency organizations, venture capital firms, and Web3 developers. Attackers use social engineering tactics to convince victims to download malware disguised as a legitimate Zoom update. Once installed, the malware executes a multi-stage infection chain, leveraging trusted macOS components to evade security measures. It collects sensitive information, including cryptocurrency wallets and SSH keys, and sends it to North Korean-controlled servers. The campaign signifies a shift towards trust abuse rather than traditional exploitation methods. Security researchers from LevelBlue's SpiderLabs attribute this activity to Sapphire Sleet based on familiar tactics and techniques. The campaign is ongoing, with significant implications for affected sectors.