Sapphire Sleet - Osascript Credential Phishing

Ibrahim Saud@tektrix

•updated Jun 21, 2026•1•0•10

Detects the execution of 'osascript' with command-line arguments indicative of a credential phishing attempt, specifically looking for prompts that display a dialog asking for a password with a hidden answer field. This is associated with the Sapphire Sleet threat actor's macOS intrusion techniques.