Sapphire Sleet macOS Malware Abuses curl-to-osascript Execution for Multi-Stage Payload Delivery

Sapphire Sleet’s latest macOS campaign uses crafted .scpt AppleScript lures that pipe curl output directly to osascript, enabling a compact, multi-stage payload chain that executes entirely within Script Editor and evades many built‑in macOS protections.

The infection begins with a socially engineered lure fake SDK or update AppleScript files such as Zoom SDK Update.scpt or msteams sdk update.scpt that open in macOS Script Editor and display a long benign-looking comment block while malicious logic sits below the visible area.

When the victim opens the file, the script invokes curl to fetch remote AppleScript stages and pipes the fetched content straight into osascript (cript (curl | osascript).

Triggering cascading AppleScript stages that download additional components, register the host with C2, and deploy backdoors and credential harvesters without writing initial stages to disk.

According to Microsoft Threat Intelligence, attributes the activity to the North Korean actor known as Sapphire Sleet and notes the actor’s continued refinement of social‑engineering lures, delivery infrastructure, and staging patterns, including a recent Teams‑themed variant.

This curl→osascript chaining provides operational advantages: it preserves a user‑initiated execution context that sidesteps Gatekeeper, notarization and quarantine checks, and it allows dynamic, per‑stage payload selection via distinct user‑agent identifiers such as mac-cur1 through mac-cur5.

Sapphire Sleet macOS Malware

The mac-cur1 stage acts as an orchestrator and deploys a host monitoring component (observed as com.apple.cli or com.microsoft.helper in variants).

A services backdoor that installs persistence via launch plists, while mac-cur2/mac-cur4 deliver a credential harvester app (systemupdate.app) that displays a native-looking password prompt and exfiltrates validated credentials to the actor via the Telegram Bot API.

To scale data collection, Sapphire Sleet macOS Transparency, Consent, and Control (TCC) protections by programmatically manipulating the user TCC database.

The campaign coerces Finder to allow read/write access to the TCC folder, injects AppleEvents grants for osascript via sqlite3 entries bound to Apple code‑signing requirements, and restores the database thereby granting osascript silent AppleEvents privileges required for file collection and automation.

With TCC modified, the malware enumerates and exfiltrates high‑value artifacts browser profiles and IndexedDB wallet data, keychain files (decryptable with the captured password), Telegram session data, desktop wallet files (Ledger Live, Exodus), SSH keys, Apple Notes, and system logs using nohup’ed uploads and consistent upload headers tied to the device UUID.

Microsoft and Apple coordinated mitigations after disclosure: Apple rolled out XProtect signatures and Safe Browsing protections, while Microsoft expanded Defender detections, added hunting queries, and published behavioral guidance for defenders to monitor piped curl executions, suspicious osascript activity.

Recommended controls include blocking or auditing .scpt execution and unsigned binaries, limiting or alerting on curl piped to interpreters, monitoring Library/Application Support/com.apple.TCC/TCC.db operations, enforcing least privilege for sensitive apps, and protecting cryptocurrency workflows with hardware wallets and credential rotation.

For technical teams investigating similar incidents, Microsoft’s blog post provides detailed indicators of compromise, detection names, and hunting guidance, and public reporting from security outlets summarizes the campaign’s use of cascading curl→osascript stages and Teams/Zoom‑themed lures.

Security teams should treat any unsolicited request to download or run update files especially compiled AppleScript (.scpt) as high risk and verify downloads through vendor channels before execution.

Indicators of compromise

Malicious file hashes

File	SHA-256
/Users/<user>/Downloads/Zoom SDK Update.scpt	2075fd1a1362d188290910a8c55cf30c11ed5955c04af410c481410f538da419
MSTeams SDK Update.scpt	980bf65c703edae7b28a752207a84b80332be0dae4ee87f00928f82a011ab0ce
/Users/<user>/com.apple.cli	05e1761b535537287e7b72d103a29c4453742725600f59a34a4831eafc0b8e53
/Users/<user>/com.microsoft.helper	3e6fcace412827b14d4af9fc7ca1b8867f75f40c589f3fdca50e988466f00279
/Users/<user>/.google.doc	5f457c492773b832054d007ba94d2e89c22dac8458dc9dc1b1d91896777c0c9f
/Users/<user>/.com.apple.helpers	97ccc28808d2c21b83f24835744af754920a992e57216d2cbc8315664905b0e2
/Users/<user>/Library/Services/services services / icloudz	5fbbca2d72840feb86b6ef8a1abb4fe2f225d84228a714391673be2719c73ac7
com.google.chromes.updaters	5e581f22f56883ee13358f73fabab00fcf9313a053210eb12ac18e66098346e5
com.google.webkit.service.plist	95e893e7cdde19d7d16ff5a5074d0b369abd31c1a30962656133caa8153e8d63
com.apple.identification.plist	fcd0c4f9d4311de6f400cc61f476dd60ae06f8d19568dbbaa1a118e1a0ff68ab
/private/tmp/SystemUpdate/systemupdate.app/Contents/MacOS/Mac Password Popup	8fd5b8db10458ace7e4ed335eb0c66527e1928ad87a3c688595804f72b205e8c
/private/tmp/SoftwareUpdate/softwareupdate.app/Contents/MacOS/Mac Password Popup	a05400000843fbad6b28d2b76fc201c3d415a72d88d8dc548fafd8bae073c640

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.