Adversary Intelligence — 2026-04-16
Microsoft Attributes macOS Campaign Targeting Crypto Firms to North Korean Sapphire Sleet
Microsoft Threat Intelligence disclosed a macOS-focused
Analysis
Sapphire Sleet's move from npm supply-chain compromise to direct TCC database manipulation is a capability jump allied cyber services should treat as likely imminent across other Apple-dominant crypto and VC markets. Apple's consent-prompt layer was the backstop when user training failed, and it no longer holds. Per Microsoft Threat Intelligence (sole source; IOCs and TTPs provided, prior attributions have held, though Google TAG or Mandiant corroboration would firm the picture), CISA and NCSC advisory updates are likely within two weeks. Pyongyang's sanctioned procurement runs on stolen crypto flows; this campaign is purpose-built to siphon them, which sharpens the NSD case against facilitators. A competing read is that the operation belongs to a specialist unit within UNC1069 that Microsoft has labeled Sapphire Sleet for naming continuity, concentrating rather than expanding the DPRK crypto-theft threat picture, but the TCC-bypass exposure defender playbooks must now account for is unchanged either way.
Sapphire Sleet's move from npm supply-chain compromise to direct TCC database manipulation is a capability jump allied cyber services should treat as likely imminent across other Apple-dominant crypto and VC markets. Apple's consent-prompt layer was the backstop when user training failed, and it no longer holds. Per Microsoft Threat Intelligence (sole source; IOCs and TTPs provided, prior attributions have held, though Google TAG or Mandiant corroboration would firm the picture), CISA and NCSC advisory updates are likely within two weeks. Pyongyang's sanctioned procurement runs on stolen crypto flows; this campaign is purpose-built to siphon them, which sharpens the NSD case against facilitators. A competing read is that the operation belongs to a specialist unit within UNC1069 that Microsoft has labeled Sapphire Sleet for naming continuity, concentrating rather than expanding the DPRK crypto-theft threat picture, but the TCC-bypass exposure defender playbooks must now account for is unchanged either way.
1 sources
- Dissecting Sapphire Sleet’s macOS intrusion from lure to compromise -
Microsoft Threat Intelligence