MalwareUsed by 1 actor

systemupdate.app

systemupdate.app is a macOS credential-harvesting malware component used in a multi-stage campaign attributed by Microsoft Threat Intelligence to the North Korean threat actor Sapphire Sleet. It is delivered as part of a socially engineered infection chain centered on a fake Zoom SDK update and fraudulent job interview workflows, targeting victims in cryptocurrency, finance, venture capital, and blockchain sectors. The malware masquerades as a legitimate macOS system update utility and displays a native-looking password prompt claiming a software update requires the user’s password. When the victim enters credentials, systemupdate.app validates the password locally against the authentication database and immediately exfiltrates it to the operator via the Telegram Bot API. In the observed chain, mac-cur2 delivers systemupdate.app, mac-cur4 downloads a compressed archive containing it, and a second fake application, softwareupdate.app, displays a false "system update complete" message to reduce suspicion. The broader campaign also included staged AppleScript and curl-to-osascript execution, TCC database manipulation, persistence via LaunchDaemon entries, and theft of Telegram data, browser credentials, cryptocurrency wallet keys, SSH keys, and keychain data.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

APT38

The mac-cur2 stage delivers the credential harvester, “systemupdate.app,” which displays a native password dialog identical to a real system prompt. When the user enters their password, the malware validates it against the local authentication database and immediately sends it to Sapphire Sleet via the Telegram Bot API. A second fake application named “softwareupdate.app” then displays a “system update complete” message so the victim has no reason to grow suspicious.

via cyber security newscybersecuritynews.com

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078Valid AccountsEvidence1

First, the binary validates the entered password against the local macOS authentication database using directory services, confirming that the credential is correct and not mistyped.

Execution

1 technique

T1059.002AppleScriptEvidence1

Next, the script executes its malicious payload via curl to fetch a new attacker-controlled AppleScript that launches directly within the Script Editor context and ensures that additional payloads are dynamically downloaded and executed.

Persistence

1 technique

T1078Valid AccountsEvidence1

First, the binary validates the entered password against the local macOS authentication database using directory services, confirming that the credential is correct and not mistyped.

Privilege Escalation

1 technique

T1078Valid AccountsEvidence1

First, the binary validates the entered password against the local macOS authentication database using directory services, confirming that the credential is correct and not mistyped.

Stealth

2 techniques

T1036MasqueradingEvidence3

The script invokes the legitimate macOS “softwareupdate” binary with an invalid parameter to mimic a real system process... A backdoor named “services” simultaneously installs a launch daemon called “com.google.webkit.service.plist,” named to closely mimic legitimate Apple and Google services so it persists across reboots without drawing attention.

T1078Valid AccountsEvidence1

First, the binary validates the entered password against the local macOS authentication database using directory services, confirming that the credential is correct and not mistyped.

Credential Access

2 techniques

T1056Input CaptureEvidence1

The dialog prompts the user to enter their password 'to complete a software update,' and this allows Sapphire Sleet to obtain valid user credentials, exfiltrating them by using the Telegram Bot API.

T1649Steal or Forge Authentication CertificatesEvidence2

Collection

1 technique

T1056Input CaptureEvidence1

The dialog prompts the user to enter their password 'to complete a software update,' and this allows Sapphire Sleet to obtain valid user credentials, exfiltrating them by using the Telegram Bot API.

Exfiltration

1 technique

T1567Exfiltration Over Web ServiceEvidence2

The dialog prompts the user to enter their password 'to complete a software update,' and this allows Sapphire Sleet to obtain valid user credentials, exfiltrating them by using the Telegram Bot API.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app5 months ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cyber security newsNews

Apr 17, 2026

Fake Zoom SDK Update Delivers Sapphire Sleet Malware in New macOS Intrusion Chain

A macOS credential-harvesting and data-stealing component used in Sapphire Sleet’s fake Zoom SDK update campaign. It presents a fake native password prompt, validates the entered password locally, exfiltrates it via Telegram Bot API, and supports broader theft of browser credentials, crypto wallet keys, SSH keys, Telegram session data, and keychain data.

microsoft security blogNews

Apr 16, 2026

Dissecting Sapphire Sleet’s macOS intrusion from lure to compromise | Microsoft Security Blog

A fake macOS update application used to harvest the victim's password via a convincing native-looking prompt, validate the password locally, and exfiltrate it through the Telegram Bot API.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

systemupdate.app