Executive Summary
Since early 2026, a threat actor closely linked to North Korean groups Sapphire Sleet (Microsoft) and BlueNoroff (Kaspersky) has been distributing AppleScript-based malware targeting macOS users in cryptocurrency organizations. The campaign, dubbed GhostCall or GhostHire, utilizes social engineering lures masquerading as audit forms to trick users into executing malicious scripts that manipulate the Transparency, Control, and Consent (TCC) database.
The attack chain involves a multi-stage AppleScript execution that attempts to escalate privileges by directly writing to the userspace TCC.db file using Finder AppleEvents. This allows the malware to grant itself access to sensitive directories (Desktop, Downloads, Documents) and automation control without triggering standard user prompts. The final payload, ptApp, is a persistent backdoor that facilitates file exfiltration and further command execution.
While recent macOS security patches (Tahoe 26.4.1+ and Sequoia 15.7.7+) have largely mitigated this specific TCC directory renaming technique, the actor remains active. The continued success of these campaigns highlights the importance of timely patching and monitoring for unauthorized modifications to security databases on developer and high-value macOS endpoints.