LevelBlue Details Sapphire Sleet macOS Campaign Using Fake Zoom SDK Update

May 28, 2026 · Original article ↗

Summary

LevelBlue describes a Sapphire Sleet campaign targeting macOS users in financial, Web3, and cryptocurrency sectors. A fake Zoom SDK update delivered AppleScript payloads that abused TCC permissions, established persistence, and collected credentials and sensitive data.

Key points

The reported targets included venture capital firms, Web3 developers, and cryptocurrency organizations, approached through professional and messaging channels.
Victims were persuaded to run a fake Zoom SDK update AppleScript, which used whitespace padding to obscure its malicious logic and chained Script Editor, osascript, curl, and shell.
A fake systemupdate.app displayed a password prompt to harvest user credentials.
The malware reportedly abused Finder’s Full Disk Access to modify TCC.db and grant osascript automation permissions without security prompts.
A LaunchDaemon launched the icloudz backdoor, which reflectively loaded a beacon into memory.
The campaign targeted cryptocurrency wallets, browser-extension storage, Telegram sessions, SSH keys, and Apple Notes; staged archives were uploaded to remote infrastructure.
The article says Microsoft shared findings with Apple and that campaign-related infrastructure and malware received detection and blocking updates; it warns that the tradecraft may persist despite mitigation of some infrastructure.

Article Details

Attack Vectors: Social engineering through LinkedIn, Telegram, email, and other professional channels, with the attacker posing as a recruiter, investor, or business partner and directing the victim to run a fake Zoom SDK update AppleScript.
The AppleScript was opened in Script Editor, used whitespace padding to obscure its logic, and chained osascript, curl, and shell commands to deliver follow-on payloads.
A fake systemupdate.app displayed a native-looking password prompt to steal the victim’s login password.
The malware abused Finder and TCC.db to grant osascript automation permissions, then established persistence through a LaunchDaemon that loaded icloudz and reflectively loaded the com.google.chromes.updaters beacon.
The operation collected cryptocurrency wallet data, browser extension storage, Telegram session profiles, SSH keys, and Apple Notes content, then staged archives and uploaded them to remote infrastructure.
Defensive Notes: The article reports that Microsoft shared findings with Apple, leading to updates intended to detect and block campaign-related infrastructure and malware.
Monitor the Script Editor → osascript → curl execution chain, unauthorized TCC.db modifications or automation grants, and suspicious LaunchDaemons.
The article warns that historical indicators may become less effective as the actor can move to new domains, filenames, and payloads.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`check02id[.]com`	Listed as a C2 domain used for campaign check-ins and staging.
DOMAIN	`ur01webzoom[.]us`	Listed as a C2 domain used by the campaign.
DOMAIN	`uv01webzoom[.]us`	Listed as a C2 domain used by the campaign.
DOMAIN	`uv03webzoom[.]us`	Listed as a C2 domain used by the campaign.
DOMAIN	`uv04webzoom[.]us`	Listed as a C2 domain used by the campaign.
DOMAIN	`uw03webzoom[.]us`	Listed as a C2 domain used by the campaign.
DOMAIN	`uw04webzoom[.]us`	Listed as a C2 domain used by the campaign.
DOMAIN	`uw05webzoom[.]us`	Listed as a C2 domain used by the campaign.
DOMAIN	`ux06webzoom[.]us`	Listed as a C2 domain used by the campaign.
IPV4	`104[.]145[.]210[.]107`	Reported as an endpoint for campaign exfiltration traffic.
IPV4	`83[.]136[.]208[.]246`	Listed as a remote command-and-control and exfiltration endpoint.
IPV4	`83[.]136[.]208[.]48`	Listed as a C2 IP used by the campaign.
IPV4	`83[.]136[.]209[.]22`	Listed as a C2 IP used by the campaign.
IPV4	`83[.]136[.]210[.]180`	Listed as a C2 IP used by the campaign.
SHA256	`05e1761b535537287e7b72d103a29c4453742725600f59a34a4831eafc0b8e53`	SHA-256 hash identified for the com.apple.cli profiling component.
SHA256	`2075fd1a1362d188290910a8c55cf30c11ed5955c04af410c481410f538da419`	SHA-256 hash identified for the malicious Zoom SDK Update.scpt AppleScript.
SHA256	`5e581f22f56883ee13358f73fabab00fcf9313a053210eb12ac18e66098346e5`	SHA-256 hash identified for the com.google.chromes.updaters beacon.
SHA256	`5fbbca2d72840feb86b6ef8a1abb4fe2f225d84228a714391673be2719c73ac7`	SHA-256 hash identified for the icloudz backdoor component.
SHA256	`8fd5b8db10458ace7e4ed335eb0c66527e1928ad87a3c688595804f72b205e8c`	SHA-256 hash identified for the Mac Password Popup credential-harvesting binary in the SystemUpdate staging directory.
SHA256	`95e893e7cdde19d7d16ff5a5074d0b369abd31c1a30962656133caa8153e8d63`	SHA-256 hash identified for the persistence LaunchDaemon plist.
SHA256	`a05400000843fbad6b28d2b76fc201c3d415a72d88d8dc548fafd8bae073c640`	SHA-256 hash identified for the Mac Password Popup credential-harvesting binary in the SoftwareUpdate staging directory.