Microsoft reported in April 2026 on a macOS-focused intrusion campaign conducted by the threat actor Sapphire Sleet. The operation uses targeted social engineering lures to trick users into executing malicious payloads, leading to full system compromise. The campaign highlights a growing focus on macOS environments, particularly among high-value targets. The attack begins with carefully crafted lures that convince users to download and execute malicious files disguised as legitimate applications or updates. Once executed, the malware establishes persistence and initiates communication with command-and-control (C2) infrastructure. The intrusion chain includes multiple stages designed to evade detection, maintain access, and enable follow-on actions such as data collection and remote command execution. Sapphire Sleet leverages native macOS functionality and blends malicious activity with legitimate processes, reducing visibility for traditional security tools. The campaign demonstrates strong operational discipline, using staged payload delivery and controlled execution to minimize exposure.

Impact: Successful compromise results in persistent access to macOS systems, enabling data exfiltration, credential theft, and further lateral movement. The use of social engineering and trusted-looking applications increases the likelihood of user execution, while stealth techniques extend dwell time. Organizations with macOS endpoints face increased risk, particularly if visibility into endpoint behavior is limited.

Recommendation: Organizations should restrict execution of untrusted applications and enforce application allowlisting on macOS devices. Monitor for unusual process behavior, persistence mechanisms, and outbound connections to unknown infrastructure. Implement endpoint detection and response (EDR) solutions capable of detecting macOS-specific threats. Educate users on targeted phishing and software download risks, especially for unsolicited or unexpected applications. Strengthen visibility into macOS environments and treat them as equal risk to Windows systems in enterprise security strategies.

Elastic Security Labs reported in April 2026 on a technique dubbed “Phantom in the Vault,” where attackers target sensitive secrets directly in memory rather than stealing them from disk or configuration files. The research highlights how modern applications and vaulting solutions protect secrets at rest and in transit, but still expose them temporarily in plaintext within application memory during runtime. Attackers exploit this gap by dumping process memory or injecting into running applications to extract credentials, API keys, and tokens while they are actively in use. This approach bypasses traditional protections such as encryption, secrets managers, and secure storage mechanisms because the data is accessed after it has already been decrypted for legitimate use. The technique is particularly effective in cloud-native and containerized environments, where applications frequently retrieve secrets dynamically from vaults. Once accessed, these secrets can be reused to authenticate to services, escalate privileges, or move laterally across infrastructure.

Impact: This technique enables attackers to bypass standard credential protection mechanisms and gain access to high-value secrets without triggering traditional detection controls. Compromise of these secrets can lead to unauthorized access to cloud services, databases, and internal systems. Because the activity occurs within legitimate processes, it is more difficult to detect and may result in prolonged attacker presence.

Recommendation: Organizations should implement runtime security controls that monitor for abnormal memory access, process injection, and credential harvesting behavior. Limit the exposure window of sensitive secrets by using short-lived tokens and just-in-time access mechanisms. Enforce least privilege for applications and services accessing secrets. Monitor for unusual access patterns to vault services and correlate them with endpoint activity. Treat in-memory secrets as a critical attack surface and extend detection capabilities beyond traditional storage protections.

Kaspersky reported in April 2026 on a financial threat in Latin America involving a remote access trojan (RAT) known as Janelar. The malware is designed to target financial institutions and their customers, using phishing and social engineering techniques to gain initial access. Once executed, Janelar establishes persistent remote control over the infected system. The malware operates by injecting itself into legitimate processes and maintaining communication with command-and-control (C2) infrastructure to receive instructions. It is capable of monitoring user activity, capturing credentials, and interacting with financial applications. Its design allows attackers to observe and manipulate sessions in real time, enabling fraudulent transactions and account takeover. Janelar is tailored for financial targeting, focusing on banking systems and user interactions with financial platforms. The malware’s ability to blend into legitimate processes and maintain persistent access increases its effectiveness and reduces detection likelihood.

Impact: Successful infection enables attackers to steal banking credentials, hijack sessions, and perform unauthorized financial transactions. This can lead to direct financial loss, fraud, and reputational damage for both users and financial institutions. The malware’s persistence and stealth increase the likelihood of prolonged compromise.

Recommendation: Organizations should strengthen endpoint detection to identify process injection and abnormal behavior in financial applications. Monitor for suspicious outbound connections to unknown infrastructure and unusual session activity. Implement multi-layered fraud detection that includes device and session monitoring. Educate users on phishing risks, particularly those targeting financial services. Enforce strong authentication controls and limit exposure of sensitive financial operations to compromised endpoints.