Sapphire Sleet macOS Social Engineering Intrusion

Microsoft Threat Intelligence has identified a sophisticated macOS campaign attributed to Sapphire Sleet (also known as BlueNoroff or UNC1069), a North Korean state-sponsored actor. The campaign leverages social engineering, masquerading as technical recruiter outreach or software updates, to trick users into executing malicious compiled AppleScript (.scpt) files. This approach bypasses traditional macOS security controls like Gatekeeper and TCC by operating within a user-initiated context through legitimate first-party applications like Script Editor.

The attack chain involves cascading curl-to-osascript execution to deliver multiple payloads, including host monitors, backdoors (services, icloudz), and credential harvesters. The actor utilizes a novel TCC database manipulation technique to grant unauthorized permissions and exfiltrate highly sensitive data, including cryptocurrency wallets, Telegram sessions, and keychain databases. This activity poses a critical risk to organizations in the financial, blockchain, and venture capital sectors.

Immediate defense is required through monitoring for unauthorized TCC.db modifications and auditing LaunchDaemon installations. Apple and Microsoft have implemented platform-level protections to block the identified infrastructure and malware families, including XProtect and Microsoft Defender signatures.