Fake Zoom Installer Uses .NET Downloader to Deliver Overlord RAT on macOS
Summary
Jamf Threat Labs analyzed a fake Zoom installer that uses a .NET downloader to deliver Overlord RAT on macOS. The researchers describe its execution, C2 configuration and capabilities; they do not attribute the campaign to a specific actor.
Key points
- The ARM64 macOS downloader is a self-contained .NET 10 application disguised as a Zoom installer; its initial delivery vector remains under investigation.
- The downloader identifies the operating system and architecture, fetches a platform-specific payload, and installs the legitimate Zoom app as a lure.
- On macOS, it saves the second-stage Overlord agent to /tmp/ZoomMeetings and launches it in the background.
- The analyzed agent connects over secure WebSocket to the hardcoded C2 hub[.]zoom[.]com[.]kg:5173; certificate verification is disabled in this build.
- Overlord includes keylogging, screen, audio and webcam capture, file and process controls, command execution, and remote desktop capabilities.
- Persistence is opt-in in one build, but a second identified variant installed itself and a LaunchAgent; it also collected the device hardware UUID, serial number and model identifier.
- Jamf noted similarities to other macOS activity but said it had not identified direct overlap or attributed this campaign to a specific actor.
Article Details
- Attack Vectors
- A fake Zoom installer, named ZoomMeetings, delivered a macOS ARM64 .NET downloader; the initial delivery vector remains under investigation.
- The downloader selected a platform-specific payload and fetched it from attacker-controlled infrastructure. On macOS, it saved the second stage to /tmp/ZoomMeetings and launched it in the background.
- The downloader also fetched the legitimate Zoom installer to maintain the lure.
- A second Overlord build copied itself to ~/Library/Application Support/Overlord/com.zoom and installed a LaunchAgent at ~/Library/LaunchAgents/com.zoom.plist.
- Defensive Notes
- Jamf recommends configuring threat prevention, advanced threat controls, and web protection in Jamf for Mac to Block and Report.
- The observed Overlord build connected to a hardcoded C2 address over secure WebSocket with TLS certificate validation disabled.
- Persistence is opt-in in the described Overlord build; the first observed sample did not install a LaunchAgent, while a second variant did.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | hub[.]zoom[.]com[.]kg | Hardcoded C2 domain used by the Overlord builds over secure WebSocket. |
| SHA256 | 2c0bb97632bb9b90ee97be2ac350a557b08d84a7dad1f3ef63ffd83be1ab1f00 | SHA-256 of the Overlord agent hosted as zoomMacArm on the attacker server. |
| SHA256 | 7878031f2bd907e7300133b3e8ce640f3cdcba56686eaca3539d4c22773bc233 | SHA-256 of a second ZoomMeetings binary confirmed by dynamic analysis as a differently configured Overlord build. |
| SHA256 | 7a2318127cabf28552a8aeed14a8445c8f36fbda5e57d8b122cf6f1c6b51a522 | SHA-256 of the fake Zoom installer downloader named ZoomMeetings. |
| SHA256 | b5f1a21dcd315676a4a9217a40ef830c159121528114c6436e671c2fa5455681 | SHA-256 of the malicious DLL extracted from the downloader. |
| SHA256 | d4cf150d6effeea315f136cdf448e32f4a8daac9e95f46def6a31ba18787dae3 | SHA-256 of a second .NET downloader, named ZoomInstallerFull, identified using the same attacker infrastructure. |
MITRE ATT&CK
T1036 · MasqueradingThe downloader was disguised as a Zoom installer named ZoomMeetings.T1056.001 · KeyloggingThe Overlord framework includes a keylogging capability that captures keystrokes system-wide via CGEventTap.T1059 · Command and Scripting InterpreterThe framework supports running commands through bash, python3, ruby, node, perl, or PowerShell (pwsh).T1059.004 · Unix ShellOn macOS, the downloader launched the second stage using a backgrounded nohup command.T1071.001 · Web ProtocolsThe Overlord agent communicates with its hardcoded C2 over secure WebSocket.T1082 · System Information DiscoveryThe framework collects system information including CPU, RAM, battery, macOS version, architecture, and admin status.T1083 · File and Directory DiscoveryThe framework can browse the filesystem and read files.T1105 · Ingress Tool TransferThe downloader fetched a platform-specific second-stage payload from attacker-controlled infrastructure.T1113 · Screen CaptureThe Overlord framework includes screen capture and streams frames to the operator.T1123 · Audio CaptureThe Overlord framework includes microphone audio capture.T1125 · Video CaptureThe Overlord framework includes webcam access and video capture.T1547.011 · Plist ModificationA second Overlord variant installed a LaunchAgent at ~/Library/LaunchAgents/com.zoom.plist.
People
Threat Actors
Malware
FlexibleFerretvariant observed here shares a LaunchAgent label (com.zoom) and plist name (com.zoom.plist) with FlexibleFerret, a DPRK-attributed macOS malware family associated with the Contagious Interview campaign andOverlordThreat Labs recently identified a campaign using a fake Zoom installer to deliver a configured build of Overlord, an open-source remote access framework, hosted on attacker-controlled infrastructure. The downloader is
Products
Tools
Garbleand saved to disk at the path /tmp/ZoomMeetings. It is built from the Overlord framework, compiled with garble obfuscation, and carrying a hardcoded C2 server address.GoReSymand obfuscates the moduledata structure that tools use to locate it, breaking static analysis tooling. GoReSym, which has specific recovery strategies for garbled binaries, could not resolve a function table on thisilspycmdThe malicious DLL (b5f1a21dcd315676a4a9217a40ef830c159121528114c6436e671c2fa5455681) was decompiled with ilspycmd, revealing the obfuscated C# string table.