Microsoft attributes a macOS intrusion chain to Sapphire Sleet, a North Korean state actor focused on cryptocurrency, finance, venture capital, and blockchain targets. The campaign uses recruiter-style social engineering to make victims run a fake “Zoom SDK Update.scpt” AppleScript, then chains curl-to-osascript payloads for reconnaissance, persistence, credential harvesting, TCC manipulation, and collection of wallets, browser data, keychains, Apple Notes, and Telegram data. A disguised Mach-O host-monitoring component named com.apple.cli gathers system and process information while maintaining outbound connectivity to 83.136.208[.]246:6783, alongside additional staged backdoor and credential-harvesting components. The activity matters because it shows Sapphire Sleet relying on trusted macOS utilities and user-initiated execution rather than software exploitation to bypass Gatekeeper, quarantine, notarization, and other platform controls.