Sapphire Sleet Campaign User-Agent Strings in Curl Commands

Tim Peck@timpeck

•updated Apr 17, 2026•11•0•651

Detects curl commands using user-agent strings that Sapphire Sleet uses as campaign tracking identifiers in their macOS intrusion chain. Each stage of the cascading payload delivery uses a distinct UA (mac-cur1 through mac-cur5) to route requests to different server paths serving AppleScript payloads or ZIP archives containing malicious .app bundles.