New Campaign Targets Mac Users With Novel Malware

Microsoft has uncovered a new campaign by the North Korean state-sponsored APT Sapphire Sleet that targets macOS systems with a combination of social engineering and malware installation in an effort to steal sensitive data and cryptocurrency assets.

The campaign targets high-value individuals and organizations in the cryptocurrency, digital assets, and finance sectors, which are the group’s  main focus for generating revenue through theft. Sapphire Sleet achieved a highly reliable infection chain by relying on victims opening a malicious file to establish persistence and exfiltrate sensitive data. Sapphire Sleet’s tactics evade macOS security enforcement boundaries such as Transparency, Consent, and Control (TCC), Gatekeeper, and notarization checks.

Sapphire Sleet has been active for at least six years and is notorious for using sites usch as LinkedIn to make direct approaches to victims, and like most other DPRK actors is in it for the money.

The Attack Chain: From Fake Recruiters to Credential Theft

Sapphire Sleet continues its well-worn social engineering tactics, creating bogus recruiter profiles on professional platforms to engage targets and direct them to install malware disguised as a Zoom SDK update. The initial access involves directing the victim to download a compiled AppleScript file, such as Zoom SDK Update.scpt. When opened in the macOS Script Editor, the script presents a large, decoy comment block to mimic benign upgrade instructions, but hides its malicious logic by inserting thousands of blank lines below the scrollable view.

The hidden code executes a multi-stage payload delivery process that includes a critical step for credential harvesting. A malicious application named systemupdate.app is deployed, which immediately presents the user with a visually indistinguishable native macOS password dialog. The malware then validates the entered password against the local authentication database and, upon success, immediately exfiltrates the verified credential to the threat actor’s infrastructure using the Telegram Bot API.

Advanced Persistence and TCC Bypass

Following credential harvesting, Sapphire Sleet focuses on establishing deep and evasive persistence. A primary backdoor, the .services binary, is deployed through a launch daemon for automatic execution at system startup, even when no user is signed in. This component also deploys two additional backdoors, including icloudz, which functions as a reflective code loader to pull and execute payloads directly into memory, and com.google.chromes.updaters, a 7.2MB component designed for lightweight beaconing and communication with the C2 domain check02id[.]com.

To ensure large-scale data access and exfiltration, the actor must bypass macOS TCC protections. Sapphire Sleet does this by directing the Finder app  to rename the TCC database folder. This allows the malware to copy and inject a new entry into the database, granting /usr/bin/osascriptthe necessary AppleEvents permissions to communicate with Finder without triggering any user prompt.

Once persistence and privileges are secured, a final 575-line AppleScript payload is executed using nohup to systematically collect, compress, and exfiltrate seven categories of data, ensuring the operation completes reliably in the background.

Microsoft shared the details of this campaign with Apple and Apple has since implemented platform-level updates to help detect and block the associated infrastructure and malware. This includes deploying XProtect signatures to block the malware families and Apple Safe Browsing protections in Safari to block malicious infrastructure.

North Korean threat actors continue to be among the more active and creative attackers on the landscape at the moment. Their exploits are too numerous to list here, but some recent notable intrusions by DPRK groups include the meticulous Drift protocol heist and the Axios NPM supply chain attack.