North Korean APT Targets macOS to Steal Crypto Wallets and SSH Keys

A newly uncovered macOS intrusion campaign attributed to the North Korean state-sponsored threat group Sapphire Sleet, also known as BlueNoroff or UNC1069, is targeting high-value organizations in the financial and cryptocurrency sectors.

The operation focuses on venture capital firms, Web3 developers, and crypto platforms, highlighting a continued shift in North Korean cyber operations toward financially motivated espionage and theft.

Active since at least 2020, Sapphire Sleet has steadily refined its tactics. Earlier campaigns relied on basic delivery methods such as malicious macros, but recent activity demonstrates a clear evolution toward sophisticated macOS-native techniques.

Initial access begins with targeted social engineering. Threat actors approach victims through professional platforms such as LinkedIn, Telegram, or email while posing as recruiters, investors, or business partners.

Victims are invited to a meeting and instructed to install what appears to be a Zoom SDK update. This file, named “Zoom SDK Update.scpt,” is actually a compiled AppleScript designed to execute malicious code once opened.

When executed, the script launches within the macOS Script Editor. To evade detection, the malicious logic is hidden beneath thousands of blank lines, making it difficult for users to notice.

According to LevelBlue, campaign emphasizes trust abuse rather than exploiting software vulnerabilities, allowing attackers to operate within the boundaries of legitimate system processes and avoid traditional security detection mechanisms.

The script then triggers a chain of commands involving osascript, curl, and shell execution, ultimately delivering additional payloads onto the system.

North Korean APT Targets macOS

The malware establishes communication using multiple hardcoded user-agent strings and deploys lightweight profiling tools to gather system information.

It then proceeds to harvest user credentials by displaying a fake macOS password prompt through a malicious application named “systemupdate.app.” This prompt mimics native macOS behavior, increasing the likelihood of user compliance.

One of the most notable aspects of this campaign is its abuse of macOS privacy controls. The malware leverages the Finder application, which already has Full Disk Access permissions, to manipulate the Transparency, Consent, and Control (TCC) database.

By modifying this database, the attackers grant unauthorized automation permissions to system processes such as osascript, effectively bypassing security prompts without alerting the user.

Persistence is achieved through the creation of a malicious launch daemon placed in the system directory. This daemon executes a backdoor component at system startup, which loads the primary malware payload directly into memory using reflective loading techniques.

The malware maintains regular communication with command-and-control infrastructure, beaconing at consistent intervals.

Once established, the malware collects a wide range of sensitive data. Targeted information includes cryptocurrency wallets such as Exodus and Ledger Live, browser extension data, Telegram session files, SSH keys, and unencrypted Apple Notes.

The stolen data is compressed into archive files and staged in temporary directories before being exfiltrated to attacker-controlled servers.

Exfiltration typically occurs over encrypted channels using curl, with observed traffic directed to suspicious remote infrastructure.

Although some of the campaign’s infrastructure has reportedly been disrupted following coordinated disclosure to Apple, the techniques demonstrated in this operation remain highly effective and adaptable.

This campaign underscores a broader trend in advanced threat activity targeting macOS environments, particularly within the cryptocurrency ecosystem.

By leveraging legitimate system tools and user trust, Sapphire Sleet continues to bypass traditional defenses and extract high-value digital assets with minimal detection.

IOCs

Component/Path	SHA-256 Hash
/Users/<user>/Downloads/Zoom SDK Update.scpt	2075fd1a1362d188290910a8c55cf30c11ed5955c04af410c481410f538da419
/Users/<user>/com.apple.cli	05e1761b535537287e7b72d103a29c4453742725600f59a34a4831eafc0b8e53
/Users/<user>/Library/Services/services / icloudz	5fbbca2d72840feb86b6ef8a1abb4fe2f225d84228a714391673be2719c73ac7
com.google.chromes.updaters	5e581f22f56883ee13358f73fabab00fcf9313a053210eb12ac18e66098346e5
com.google.webkit.service.plist	95e893e7cdde19d7d16ff5a5074d0b369abd31c1a30962656133caa8153e8d63
/private/tmp/SystemUpdate/systemupdate.app/Contents/MacOS/Mac Password Popup	8fd5b8db10458ace7e4ed335eb0c66527e1928ad87a3c688595804f72b205e8c
/private/tmp/SoftwareUpdate/softwareupdate.app/Contents/MacOS/Mac Password Popup	a05400000843fbad6b28d2b76fc201c3d415a72d88d8dc548fafd8bae073c640

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.