This threat involves a sophisticated macOS intrusion campaign attributed to the North Korean threat actor Sapphire Sleet. The attack chain begins with a socially engineered lure: a malicious AppleScript file masquerading as a Zoom SDK update. This script triggers a cascade of payloads using curl-to-osascript execution chains. The attackers deploy multiple backdoors named com.apple.cli, services, icloudz, and com.google.chromes.updaters to maintain persistence and execute commands. Credential harvesting is performed through fake system dialogs mimicking legitimate macOS password prompts. The threat actor bypasses Transparency, Consent, and Control (TCC) protections by directly manipulating the TCC database, allowing broad data exfiltration. Stolen data includes cryptocurrency wallets, browser credentials, Telegram session data, SSH keys, and Apple Notes. The campaign primarily targets organizations in cryptocurrency, finance, and blockchain industries with the goal of stealing digital assets.

The campaign enables attackers to gain persistent backdoor access on macOS systems, harvest sensitive credentials, and bypass macOS security protections to exfiltrate valuable data. The primary impact is theft of digital assets including cryptocurrency wallets and credentials for various services. The manipulation of the TCC database undermines macOS's built-in privacy controls, increasing the risk of extensive data compromise. This poses a significant threat to targeted organizations in finance and blockchain sectors.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the attack relies on social engineering and malicious AppleScript execution, organizations should educate users to avoid installing unverified software updates, especially those masquerading as legitimate Zoom SDK updates. Monitoring for the presence of known backdoor components and indicators of compromise such as the listed IP addresses, domains, and file hashes can aid detection. Because the threat bypasses TCC protections by database manipulation, verifying the integrity of TCC settings and restricting unauthorized modifications may help. Follow updates from Apple and Microsoft Threat Intelligence for any official fixes or detection tools.