Microsoft Security Blog · April 16, 2026

Dissecting Sapphire Sleet’s macOS intrusion from lure to compromise

Why it matters

Microsoft details a Sapphire Sleet macOS intrusion chain that uses social engineering and user-driven execution to steal credentials and crypto assets.

My takeaway: Useful for AI security because it shows how convincing lures and user-driven execution still beat technical controls. As assistants become better at mimicry, security reviews need to assume more persuasive social-engineering content.