Loading story…
Microsoft said the North Korea-linked threat group Sapphire Sleet—also tracked as APT38 and tied to the Lazarus ecosystem—targeted macOS users in cryptocurrency, finance, venture capital, and blockchain through social engineering rather than software exploits. The operation reportedly used fake recruiter personas on platforms including LinkedIn to lure victims into sham job interviews, then directed them to open a malicious AppleScript file masquerading as a Zoom update, Zoom SDK Update.scpt. That file launched a multi-stage infection chain using native macOS tools, downloaded additional payloads, and executed in a user-initiated context to help evade protections such as Gatekeeper, notarization, quarantine enforcement, and TCC controls.
The intrusion deployed multiple backdoors, including systemupdate.app, which displayed a fake macOS password prompt to capture credentials, and icloudz, which loaded payloads directly into memory via NSCreateObjectFileImageFromMemory. Microsoft said the malware manipulated the TCC database, established persistence, and exfiltrated cryptocurrency wallets, browser data, Telegram sessions, SSH keys, Apple Notes, keychain material, and other sensitive information, with some stolen credentials sent through the Telegram Bot API. Apple was notified through responsible disclosure and subsequently added Safari Safe Browsing protections and XProtect signatures to detect and block the campaign’s infrastructure and malware.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
After Microsoft notified Apple through responsible disclosure, Apple deployed Safari Safe Browsing protections and XProtect signatures to detect and block the campaign's malware and infrastructure. This response was described as already in place by the time of Microsoft's publication.
Microsoft Threat Intelligence published technical analysis of the macOS intrusion chain, including the fake Zoom update lure, multi-stage payload delivery, persistence mechanisms, credential theft, and theft of wallets, browser data, Telegram sessions, SSH keys, and Apple Notes. The report also provided indicators of compromise, malicious hashes, command-and-control infrastructure, and Defender detection and hunting guidance.
The North Korea-linked threat actor Sapphire Sleet began targeting high-value victims in cryptocurrency, finance, venture capital, and blockchain through fake recruiter outreach and sham job interviews. Victims were tricked into opening a malicious AppleScript file posing as a Zoom SDK update, leading to credential theft, backdoor deployment, and data exfiltration on macOS systems.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 24 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
8 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourceinfosec.pub
Open sourceinfosec.pub
Open sourcebsky.app
Open sourcego.theregister.com
Open sourcedarkreading.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are increasingly targeting macOS users with **infostealers** and distribution-as-a-service models, reflecting a broader “gold rush” in Apple-focused malware development. Reporting highlights macOS stealers targeting browser credentials and cryptocurrency assets (including seed phrases) and notes tactics to evade Apple controls such as obtaining valid Apple developer signatures to bypass *Gatekeeper*; one cited example is *MacSync* being notarized and signed under Team ID `GNJLS3UYZ4`. The same reporting describes ecosystem-scale enablement, including large-scale compromise of WordPress sites for distribution and novel command-and-control approaches such as using blockchain smart contracts (e.g., on **BNB Smart Chain**), alongside paid-traffic abuse (e.g., promoting malicious AI chat content via ads) to push stealer payloads. Separately, a Darktrace-described investigation details a **multi-stage macOS malware** campaign that prioritizes *social engineering* over exploitation to defeat Apple’s **Transparency, Consent, and Control (TCC)** privacy framework. Victims are lured via phishing to open an AppleScript masquerading as a document (`Confirmation_Token_Vesting.docx.scpt`), which displays a fake “Compatibility” error and instructs the user to launch a “Compatibility Wizard” (e.g., using a keyboard shortcut) that effectively tricks them into authorizing execution and granting access. Together, the reporting indicates macOS threats are increasingly succeeding by combining credential/crypto theft objectives with user-prompt manipulation and trust-abuse techniques rather than relying on kernel or sandbox escapes.
Jun 29, 2026
Microsoft reported that **information-stealing malware activity is expanding from Windows to macOS**, driven by campaigns observed since late 2025 that rely on social engineering and cross-platform tooling. The activity includes **ClickFix-style prompts** and **malicious DMG installers** that deliver macOS-focused infostealer families such as **Atomic macOS Stealer (AMOS)**, **MacSync**, and **DigitStealer**, with operators leveraging **fileless execution**, **native macOS utilities**, and **AppleScript automation** to evade defenses and automate collection. Initial access commonly starts with **malicious search ads (e.g., Google Ads)** that redirect users to fake sites impersonating legitimate tools and then trick victims into running “fix” steps or installing trojanized software. The malware is assessed to target high-value data including browser credentials and session cookies, **iCloud Keychain** contents, crypto wallet data, and **developer secrets**; Microsoft also highlighted growing use of **Python-based stealers** distributed via phishing for rapid adaptation across heterogeneous environments, citing **PXA Stealer** (linked to Vietnamese-speaking actors) as an example used in late-2025 campaigns with persistence mechanisms such as registry `Run` keys or scheduled tasks and **Telegram** used for command-and-control.
Jun 29, 2026
Threat actors are escalating **macOS infostealer** activity through multiple distribution and evasion techniques aimed at harvesting sensitive user data. One campaign abuses trust in legitimate AI platforms by promoting shareable *ChatGPT* and *Grok* conversation links via **Google Ads**, luring users searching for common macOS troubleshooting help into running malicious Terminal commands using the **“ClickFix”** social-engineering pattern. Executing the provided shell commands results in installation of **Atomic macOS Stealer (AMOS)**, which steals browser credentials, crypto wallet seed phrases, **Keychain** data, and personal files before exfiltrating them to attacker-controlled infrastructure. Separately, **Odyssey Stealer** intrusions against macOS have surged globally, with notable targeting reported in the U.S., France, and Spain and additional impact across Europe, the Americas, and parts of Asia and Africa. Moonlock Lab reporting indicates Odyssey is delivered through **fake software updates, cracked tools, and fraudulent apps**, and is designed to evade detection by generating a **unique fingerprint per infection**, frequently changing code structure, and using many distinct **SHA-256** variants—suggesting automated builders are being used to produce large numbers of hard-to-block samples. Collectively, the reporting highlights sustained pressure on macOS users from credential-stealing malware that blends high-trust lures with rapid variant generation to hinder traditional defenses.
Jun 29, 2026