Fake macOS Software Updates Steal Passwords, Crypto Wallet Data

Key Takeaways

• A North Korean state-backed group, Sapphire Sleet, is actively targeting macOS users with sophisticated social engineering.
• The campaign uses fake software update prompts to trick users into divulging passwords and sensitive data, including cryptocurrency wallet information.
• Targets primarily include individuals and organizations in cryptocurrency, venture capital, and blockchain sectors.
• Apple has released platform-level protections, including XProtect updates, and users are urged to keep macOS updated.

Sophisticated Social Engineering Targets macOS Users

A perilous new cyberattack campaign is actively compromising macOS users, engineered to pilfer sensitive data through advanced social engineering rather than exploiting system vulnerabilities. This campaign, attributed to the North Korean state-sponsored threat actor known as Sapphire Sleet, presents a significant threat, particularly to those within the cryptocurrency, venture capital, and blockchain industries.

Operating since at least March 2020, Sapphire Sleet’s latest tactics, observed since early 2026, introduce macOS-specific attack techniques previously uncharacteristic of the group. Rather than relying on technical flaws, the attackers manipulate users into executing malicious files themselves, often under the guise of legitimate software updates.

Microsoft security researchers, who have extensively analyzed the campaign, noted these findings in a report. For a comprehensive overview of these methods, refer to the full report detailing these sophisticated social engineering tactics. The core objective of Sapphire Sleet remains consistent: to exfiltrate digital assets and financial intelligence from high-value targets globally.

Initial Lure and Malicious Execution

The attack chain typically commences with a targeted individual receiving contact on social media or professional networking platforms from an individual impersonating a job recruiter. Following initial communication, the victim is directed to download a file presented as a Zoom SDK update.

Upon execution, this seemingly benign file, which is a compiled AppleScript, launches within macOS Script Editor—a legitimate Apple utility. This script then surreptitiously downloads and executes additional malicious code in the background. The user, observing what appears to be a standard software installation process, remains unaware of the underlying compromise.

Microsoft responsibly disclosed its findings to Apple, which has since implemented platform-level defenses. These include updates to XProtect signatures and Safari Safe Browsing blocks, designed to detect and neutralize the infrastructure associated with this campaign. macOS users are strongly advised to ensure their devices are fully updated to benefit from these critical protections.

Fake Software Update Prompts Harvest Credentials

Once the initial malicious script successfully runs on the victim’s system, it deploys a fake application named systemupdate.app. This application presents a highly convincing macOS password dialog, visually identical to a genuine system prompt. Users are prompted to enter their password to complete the supposed software update, often complying without suspicion.

After the user inputs their password, the malware validates it against the local macOS authentication database. If the credential is correct, it is immediately transmitted to the attackers via the Telegram messaging service. Subsequently, a second deceptive application, softwareupdate.app, displays a “update complete” dialog, designed to allay any potential suspicions from the victim.

Concurrently, the malware initiates a comprehensive data exfiltration process, collecting sensitive information such as cryptocurrency wallet files, saved browser passwords, Telegram session data, SSH keys, Apple Notes, and browsing history.

Persistent Backdoors and Large-Scale Exfiltration

Beyond credential harvesting, Sapphire Sleet establishes multiple backdoors to ensure persistent access to compromised systems. A component named com.apple.cli functions as a host monitoring tool, maintaining continuous communication with the attackers’ command-and-control (C2) servers. A more advanced backdoor, icloudz, employs reflective code loading, executing directly in memory to minimize disk traces and evade detection by security tools.

To ensure persistence across reboots, the malware installs a launch daemon that automatically reactivates the backdoor. All stolen data is compressed into archives and uploaded to attacker-controlled servers over port 8443, while credentials are sent separately via the Telegram Bot API.

In June 2026, Microsoft identified an evolution in Sapphire Sleet’s tactics, introducing a Microsoft Teams-themed lure with updated payload names, continuing the same attack methodology under new disguises.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What You Should Do

• Update macOS Regularly: Ensure your macOS devices are always running the latest software versions to receive Apple’s platform-level protections, including XProtect signature updates.
• Exercise Caution with Downloads: Never run scripts or terminal commands shared via chat messages or unfamiliar sources without explicit approval from a trusted IT security team. Be wary of files disguised as legitimate updates or SDKs.
• Verify Software Updates: Always initiate software updates directly through System Settings (or System Preferences) or the App Store. Do not trust pop-up prompts or downloaded installers from unverified sources.
• Strengthen Authentication: For cryptocurrency assets, prioritize hardware wallets. Regularly rotate passwords, especially those stored in browsers, and utilize strong, unique passwords with multi-factor authentication (MFA) enabled wherever possible.
• Monitor Network Traffic: Organizations should monitor for unauthorized outbound connections, particularly over unusual ports like 8443, and block compiled AppleScript files downloaded from the internet.
• Audit TCC Database: Regularly monitor for unauthorized modifications to the macOS Transparency, Consent, and Control (TCC) database, which manages privacy settings and application permissions.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.