Dissecting macOS intrusion from lure to compromise

Reported 17 Apr 2026 by otx · Severity: medium

Microsoft Threat Intelligence uncovered a macOS-focused cyber campaign by North Korean threat actor Sapphire Sleet utilizing social engineering to compromise systems. The attack chain begins with a malicious AppleScript file disguised as a Zoom SDK update, which executes cascadin