Related Threat Clusters

North Korean Sapphire Sleet Targets macOS Users in New Social Engineering Campaign
A North Korean cybercrime group known as Sapphire Sleet has launched a social engineering campaign targeting macOS users, as reported by Microsoft's Threat Intelligence unit. The campaign involves tricking users into…

7 articles · Updated April 17, 2026
New macOS Malware Campaign Targets Users via Fake Updates and Script Editor
A new malware campaign is targeting macOS users with the AMOS-linked Atomic Stealer, exploiting fake software update pages and the built-in Script Editor application. Victims are tricked into executing malicious…

43 articles · Updated April 9, 2026
PamStealer: New macOS Infostealer Targets Users via Fake Maccy Manager
PamStealer is a newly identified macOS infostealer that masquerades as the legitimate Maccy clipboard manager. The malware employs a two-stage attack method, starting with a malicious AppleScript that downloads a…

86 articles · Updated July 3, 2026

Recent Intelligence Reports

Pamstealer Macos Infostealer Applescript Rust — www.jamf.com · July 6, 2026
North Korean social engineering campaign targets macOS users — Computerweekly · April 17, 2026
Atomic Stealer malware abuses macOS Script Editor in new ClickFix attack | brief — Scworld · April 9, 2026

Sapphire Sleet Malware Lazarus Operation Financial Atomic Stealer ClickFix PamStealer T1041 - Exfiltration Over C2 Channel T1056 - Input Capture T1059.004 - Unix Shell T1059.005 - Visual Basic T1059.007 - JavaScript