Microsoft Threat Intelligence (Microsoft Security Blog)
Sapphire Sleet macOS intrusion campaign (fake software update / Teams-themed lure) · 2026-04-16T15:00:00+00:00 (published_time)
Microsoft Threat Intelligence identified a campaign beginning in early 2026 by North Korean state actor Sapphire Sleet demonstrating new combinations of macOS-focused execution patterns and techniques ... Sapphire Sleet is a North Korean state actor active since at least March 2020 that primarily targets the finance sector, including cryptocurrency, venture capital, and blockchain organizations.