Sapphire Sleet uses fake updates to target macOS users

Microsoft’s April analysis described a macOS campaign it attributes to Sapphire Sleet, a North Korean threat actor. Researchers said the activity impersonated legitimate software updates and persuaded users to run malicious files. Its stated objectives included stealing passwords, cryptocurrency assets and personal information.

The report later added a June variant using a Teams-themed lure, while retaining the same broad model of user-driven execution. The changes concerned delivery, naming and persistence rather than proof of a newly exploited macOS vulnerability. The account shows why the source of an update request matters even when the operating system’s normal protections are present. Microsoft’s attribution and observed behaviour are the basis of this report.