[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3MSfHqCQPejrQZ6SugkkZa-vE0IPDrBDyO6WXiC8Qtk":3},{"article":4,"iocs":46,"watch_terms":50},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":26,"category":27,"article_tags":30},"86ba99d9-44ef-4423-8d72-362360e51e39","North Korea Uses ClickFix to Target macOS Users' Data","north-korea-uses-clickfix-to-target-macos-users-data-8a2495","Sapphire Sleet uses fake job offers and phony Zoom updates to deliver ClickFix attacks that steal credentials and sensitive data from Macs.","Sapphire Sleet, a North Korean threat actor, is leveraging ClickFix malware to target macOS users through social engineering campaigns using fake job postings and counterfeit Zoom software updates. The attack chain delivers credential theft and sensitive data exfiltration capabilities. This represents a shift in North Korean tactics to focus on macOS-specific attack vectors.","North Korean Sapphire Sleet deploys ClickFix malware via fake job offers and Zoom updates targeting macOS users.",null,"https:\u002F\u002Fwww.darkreading.com\u002Fapplication-security\u002Fnorth-korea-clickfix-target-macos-users-data","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt5cc61f368315b744\u002F69e10ffdc8863fd06c049539\u002FMac_Mouse_Click_Edwin_Remsberg_Alamy.jpg?width=1280&auto=webp&quality=80&disable=upscale","2026-04-16T19:42:45+00:00","2026-04-16T22:00:17.4833+00:00",8,[18,21,24],{"name":19,"type":20},"Sapphire Sleet","threat_actor",{"name":22,"type":23},"macOS","product",{"name":25,"type":23},"Zoom","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":26,"icon":11,"name":28,"slug":29},"Malware","malware",[31,36,41],{"category":32},{"id":33,"icon":11,"name":34,"slug":35},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":37},{"id":38,"icon":11,"name":39,"slug":40},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":42},{"id":43,"icon":11,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47],{"type":29,"value":48,"context":49},"ClickFix","macOS malware used by Sapphire Sleet for credential theft and data exfiltration",[22,25]]