TLDR Tech / InfoSec
Dissecting Sapphire Sleet's macOS intrusion from lure to compromise
Microsoft Threat Intelligence detailed a North Korean Sapphire Sleet campaign that weaponizes a fake Zoom SDK Update.scpt, abusing trusted macOS Script Editor and a cascading curl-to-osascript chain (user agents mac-cur1 through mac-cur5) to deploy com.apple.cli, services, icloudz, and com.google.chromes.updaters backdoors while harvesting credentials via a spoofed systemupdate.app dialog. The actor directly manipulates the user-level TCC.db through Finder's Full Disk Access to silently grant osascript AppleEvents permission, then exfiltrates Telegram sessions, Chromium wallet extension data (Phantom, TronLink, Coinbase, OKX, Solflare, Rabby, Backpack, and Sui), Ledger and Exodus wallets, keychains, SSH keys, and Apple Notes to 104.145.210[.]107:8443. Defenders should block .scpt execution from the internet, monitor for curl piped into osascript/sh/bash with non-standard user-agent strings, and alert on writes to ~/Library/Application Support/com.apple.TCC/TCC.db, and audit /Library/LaunchDaemons for com.google.webkit.service.plist.
Read the full story