Sapphire Sleet - Pre-execution Chmod Modifier

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•7

Identifies bash scripts leveraging 'chmod +x' inside '/tmp' or '/Users/Shared' to make a downloaded Mach-O payload executable. This activity is associated with the Sapphire Sleet threat group.