A macOS campaign described as consistent with DPRK recruitment and crypto-targeting activity used a fake “Microsoft Teams Update” AppleScript loader named Microsoft Teams Update.scpt. The script was branded as a Microsoft Teams Live SDK update and opened a legitimate Microsoft Teams page in the background to make the activity appear normal to the user. Its malicious logic used curl -L -k to fetch a second-stage script from support.ms-live[.]com/519738/check and executed the downloaded content through AppleScript. The source provides the SHA-256 hash d4310e8286fc3e29c7dce8ed8ccffe3bbc1a38369cdeec55095d5716dd89e624 and related loader hashes, giving defenders concrete macOS artifacts for hunting.