Saphire.zip [ VALIDATED — 2025 ]

: This campaign focuses on stealing cryptocurrency wallet keys (e.g., from Ledger Live or Exodus), Telegram session data, and macOS keychain databases.

: Organizations should watch for unusual outbound traffic, particularly over ports like 8443 , which is used by some Sapphire variants to upload stolen data. Zip Security: Security, IT, and Compliance Made Easy

: By convincing users to manually run these files, the malware bypasses standard security layers like macOS Gatekeeper . General Security Best Practices

: Attackers often use fake LinkedIn profiles or "technical interviews" to trick users into downloading malicious files, such as a "Zoom SDK Update".

: It can capture visual data of the victim's current activity.

: Security tools like Combo Cleaner or enterprise-grade EDR/MDR solutions can help detect and block these threats.

To protect against ZIP-based malware like SapphireStealer, experts recommend several layers of defense: