Skip to main content
IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Exposure
2 IOCs

macOS Users Targeted by Sapphire Sleet Campaign Using Script Editor and Fake Update Dialogs

Cyber Press
Cyber Press
Published June 17, 2026Original Report

Excerpt

A sophisticated cyberespionage campaign is aggressively targeting Apple computer users across high-value financial sectors worldwide. North Korean threat actors are leveraging convincing social engineering tactics to bypass built-in platform defenses entirely. Instead of exploiting traditional software vulnerabilities, this operation tricks victims into executing malicious scripts masked as everyday communication tools. The targeted attacks specifically focus on…

Read the original report →

Attack Flow9 steps · MITRE ATT&CK mapped

Initial AccessTA0001T1204
1/9
User Execution
ActionExecute malicious script
Victims are tricked into opening a malicious AppleScript file disguised as a legitimate communication tool.

Indicators of Compromise

Open the mindmap →

2 indicators

TypeIndicatorConfidenceScoreFirst Seen
SHA256980bf65c703edae7b28a752207a84b80332be0dae4ee87f00928f82a011ab0ceMediumScore 53/100First seen
SHA2562075fd1a1362d188290910a8c55cf30c11ed5955c04af410c481410f538da419MediumScore 56/100First seen

IOC Relationship Graph

Building graph…