The Sapphire Sleet campaign is a targeted intrusion operation against macOS environments in financial sectors. It leverages legitimate signed system applications to evade macOS security mechanisms and suppress system alerts, enabling execution of arbitrary code under the guise of authentic user updates. Initial infection vectors rely on social engineering, specifically convincing users to execute a malicious fake Zoom SDK update component. This campaign aligns with known macOS intrusion tradecraft and is attributed to the North Korean group Sapphire Sleet (BlueNoroff / UNC1069). Indicators include multiple IP addresses, domains, and file hashes associated with the campaign.

The campaign enables attackers to execute arbitrary code on targeted macOS systems, potentially leading to unauthorized access and control over high-value financial sector environments. By operating outside traditional macOS security enforcement and suppressing alerts, the malware increases the risk of stealthy compromise. The impact is medium severity given the targeted nature and the sectors affected, but no known exploits in the wild or patch information are available.

No official patch or remediation guidance is provided. Since the campaign relies on social engineering to trick users into executing malicious updates, organizations should educate users to verify update sources and avoid executing unsolicited update prompts. Monitoring for the provided indicators of compromise (IPs, domains, hashes) can assist in detection. Follow vendor advisories and security community updates for any emerging mitigations or patches.