🚨 Fake Zoom SDK Update Delivers DPRK Malware to macOS Users
🚨 Fake Zoom SDK Update Delivers DPRK Malware to macOS Users
North Korean threat actors have launched a sophisticated macOS malware campaign that weaponizes something far more dangerous than a software exploit:
👉 trust.
The operation, attributed to the DPRK-linked group Sapphire Sleet, uses fake recruiter conversations, staged interviews, and a malicious “Zoom SDK Update” to compromise macOS systems.
And here’s the uncomfortable truth:
💥 Fully patched Macs are still vulnerable
💥 Because the user is tricked into launching the malware voluntarily
🎭 The New macOS Attack Model
Forget Hollywood-style hacking scenes.
This campaign starts with:
fake recruiter accounts
LinkedIn-style outreach
interview invitations
“required software updates”
Victims are guided through a convincing hiring workflow until they’re asked to download:
Zoom SDK Update.scpt
Looks harmless.
It isn’t.
⚠️ What Happens After Opening the File
The file is a compiled AppleScript launched through:
👉 Apple Script Editor
A trusted native macOS application.
That matters because:
it looks legitimate
it bypasses suspicion
it can execute system-level commands
🧠 The Malware Hides in Plain Sight
The attackers intentionally padded the script with:
📄 thousands of blank lines
Why?
So the real malicious code stays hidden far below the visible portion of the script.
Classic psychological warfare.
Most users scroll a little… see nothing suspicious… and trust it.
💣 The Infection Chain
Once executed, the malware:
Step 1: Establishes Trust
Runs benign macOS processes to appear normal.
Step 2: Pulls Payloads Remotely
Uses tools like:
curl
osascript
To download additional malware components.
Step 3: Executes In Memory
Payloads are run directly in memory:
👉 minimal disk artifacts
👉 reduced antivirus detection
🔥 What Sapphire Sleet Steals
This campaign is heavily focused on:
💰 cryptocurrency
🔑 credentials
📂 sensitive enterprise data
Targeted assets include:
browser data
SSH keys
Telegram sessions
Apple Notes
system logs
crypto wallet extensions
wallet key material
Basically:
👉 everything valuable on a developer or finance workstation.
😬 The Fake Password Prompt Trick
One of the nastiest parts?
A fake app named:
Displays a realistic macOS password prompt.
Victims enter credentials believing it’s legitimate.
The password is then:
🚨 immediately exfiltrated via Telegram API
That means attackers get:
verified passwords
device identifiers
system metadata
Almost instantly.
🧬 macOS Security Protections Are Manipulated Too
The malware also tampers with:
👉 macOS TCC protections
(Transparency, Consent, and Control)
By modifying the TCC database, attackers can:
bypass privacy prompts
access sensitive apps silently
interact with protected system resources
Without triggering normal warnings.
🕵️ Persistence & Long-Term Access
The campaign deploys components disguised as:
com.apple.cli
And installs:
launch daemons
persistent background services
reconnaissance tooling
Meaning the malware survives:
🔁 reboots
🔁 logouts
🔁 user inactivity
⚠️ Why This Campaign Matters
This attack proves something huge:
👉 The future of macOS attacks is social engineering + trusted tools.
Not kernel exploits.
Not jailbreaks.
Attackers are increasingly abusing:
native applications
user trust
legitimate workflows
built-in scripting environments
To bypass platform protections entirely.
🛡️ How Organizations Defend Against This
macOS security now requires more than patching.
Immediate Recommendations:
✅ Restrict AppleScript execution
✅ Block unsigned scripting workflows
✅ Monitor osascript and curl usage
✅ Lock down TCC database modifications
✅ Educate users about fake recruiter scams
✅ Restrict launch daemon creation
🚨 Final Takeaway
Sapphire Sleet didn’t “hack” macOS.
They hacked:
👉 human behavior.
And honestly?
That’s becoming the preferred attack vector across the entire industry.
Because users trust:
Zoom
recruiters
updates
Apple dialogs
Attackers know it.
And they’re building entire malware ecosystems around that trust.
