Fake Zoom Installer Delivers Overlord RAT to macOS and Windows Systems

A malware campaign using a fake Zoom installer to deploy Overlord, an open-source remote access trojan (RAT), across both macOS and Windows systems.

Documented by Jamf, notable for its unusual delivery mechanism: a .NET-based downloader, a framework rarely used in macOS malware, which enables the same codebase to target multiple operating systems.

The malicious binary, named ZoomMeetings, is a macOS ARM64 Mach-O executable built as a self-contained .NET 10 single-file application with the runtime bundled inside.

Fake Zoom Installer Delivers Overlord RAT

Jamf Threat Labs found it undetected by static engines on VirusTotal at the time of analysis. Its code is heavily obfuscated, with method and field names replaced by random hex strings, and its internal string table encoded in base64 and XOR’d with a fixed key.

Unusually, the outer Mach-O wrapper contains 34 embedded Windows PE-format DLLs, one of which mimics legitimate Zoom installer metadata while the rest are standard .NET runtime libraries. This cross-platform packaging is what allows the same downloader to run natively on both macOS and Windows.

The downloader uses .NET’s RuntimeInformation APIs to detect the victim’s OS and architecture, then fetches one of three platform-specific payloads (macOS ARM64, macOS Intel, or Windows) from attacker infrastructure at cdn.zoom.com[.]kg, each request requiring a randomly generated token to avoid returning a 401 error.

On execution, the malware writes the payload to /tmp/ZoomMeetings, launches it via a backgrounded nohup process to survive after the downloader exits, and simultaneously downloads the legitimate Zoom installer to maintain the deception so by the time anything suspicious occurs, Zoom appears fully installed and functional.

The second-stage payload is a Mach-O ARM64 binary built from Overlord, a publicly available cross-platform RAT that communicates with its command-and-control (C2) server over encrypted WebSockets.

This build was compiled with garble obfuscation, which defeats standard Go reverse-engineering tools like GoReSym.

Overlord’s capabilities include system-wide keylogging, screen and webcam capture, microphone recording, full filesystem access, process control, remote script execution, a plugin loader for native or WebAssembly modules, self-updating, and remote desktop streaming.

The framework also supports optional persistence via a LaunchAgent and an experimental Solana blockchain-based C2 resolver, both disabled in the observed samples, which instead used a hardcoded C2 at hub.zoom.com[.]kg:5173 with TLS certificate validation turned off.

A related variant found on VirusTotal did enable persistence immediately, copying itself to Application Support and installing a LaunchAgent labeled com.zoom a label and plist name it shares with FlexibleFerret, a DPRK-attributed malware family tied to the Contagious Interview campaign.

Overlord has also previously surfaced in activity Proofpoint links to the likely North Korean cluster UNK_DeadDrop, though Jamf has not attributed this specific campaign to any actor.

Jamf Threat Labs emphasizes that this marks the first observed use of .NET as a macOS malware downloader, joining Go and Rust as cross-platform languages threat actors use to reduce development overhead while targeting multiple operating systems from a single codebase.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR