Microsoft spots Sapphire Sleet macOS attack using AppleScript and social engineering

A new macOS-focused cyber campaign linked to the North Korean threat actor Sapphire Sleet, highlighting how attackers are increasingly relying on social engineering rather than software vulnerabilities to compromise systems.

Rather than exploiting security flaws, the attackers manipulate user trust, allowing them to bypass built-in macOS protections.

The attack begins with carefully crafted social engineering tactics. Sapphire Sleet operators pose as recruiters on professional platforms and engage targets with fake job opportunities.

Victims are eventually instructed to download what appears to be a legitimate update file, often named “Zoom SDK Update.scpt.”

This file is actually a compiled AppleScript. When opened, it launches in Apple’s Script Editor, a trusted application capable of executing system-level commands.

According to Microsoft Threat Intelligence, the campaign targets macOS users by tricking them into manually executing malicious files disguised as legitimate software updates.

The script displays fake update instructions while hiding malicious code deep within the file to avoid detection.

Once executed, the script uses native tools like curl and osascript to download and run additional payloads, creating a multi-stage infection chain.

Multi-Stage Malware Execution

The campaign uses a cascading execution technique, where each stage downloads and launches the next. This method reduces the need to store files on disk, helping attackers evade detection.

Key components of the attack include:

• A reconnaissance tool that gathers system details such as device name, OS version, and running processes.
• A backdoor that enables persistent remote access using disguised system files.
• A credential harvester disguised as a system update app, prompting users to enter their macOS password.

The fake password prompt looks identical to legitimate system dialogs. Once entered, the password is verified and immediately sent to attacker-controlled servers via the Telegram API.

One notable aspect of the campaign is its ability to bypass macOS security controls like Transparency, Consent, and Control (TCC).

The first binary deployed is a host monitoring component called com.apple.cli a ~5 MB Mach-O binary disguised with an Apple-style naming convention.

Attackers manipulate the TCC database to silently grant permissions, allowing malware to access sensitive data without triggering user alerts.

The malware also establishes persistence using launch daemons and deploys additional backdoors with names mimicking Apple and Google services.

These components communicate with command-and-control servers and maintain long-term access to compromised systems.

Data Theft and Target Focus

After gaining access, the attackers collect a wide range of sensitive data, including:

• Browser credentials, cookies, and history.
• Cryptocurrency wallet data and extensions.
• macOS keychain files.
• Telegram session data.
• SSH keys and system logs.

The campaign heavily targets individuals and organizations involved in cryptocurrency, finance, and blockchain sectors, aligning with Sapphire Sleet’s known objective of financial gain.

The -i flag creates an interactive terminal context, which is required for sudo commands that expect interactive input.

Microsoft reported the findings to Apple, which has since deployed security updates, including XProtect signatures and Safe Browsing protections, to detect and block related threats.

Users are strongly advised to keep macOS systems updated and avoid executing scripts or software from untrusted sources. Organizations should also monitor unusual script execution, restrict AppleScript usage where possible, and implement layered security defenses.

This campaign highlights a growing trend in cyberattacks: exploiting human behavior rather than technical vulnerabilities. Even secure platforms like macOS can be compromised when users are persuaded to run malicious code themselves.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.