Sapphire Sleet - Base64 Payload Sourced from TXT (T1027)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•8

Detects the macOS script reading a downloaded text file, decoding the Base64 contents, and piping it to execution.