Fake Zoom Installer Uses .NET Downloader to Deploy Overlord RAT on macOS

A cross-platform malware campaign that disguises itself as a legitimate Zoom installer to deploy Overlord, an open-source remote access trojan (RAT), on both macOS and Windows machines.

Documented by Jamf, unlike most macOS malware, which typically relies on Go or Rust for cross-platform reach, this campaign’s first-stage downloader, a macOS ARM64 Mach-O binary named ZoomMeetings, was built as a self-contained .NET 10 single-file application, with the runtime bundled inside.

Because .NET assemblies use the Portable Executable (PE) format even on macOS, researchers extracted 34 embedded DLLs from the binary, one of which was disguised with metadata mimicking a genuine Zoom installer (“Zoom Communications, Inc”).

Fake Zoom Installer Uses .NET Downloader

The sample, found on VirusTotal (SHA-256: 7a2318127cabf28552a8aeed14a8445c8f36fbda5e57d8b122cf6f1c6b51a52), went undetected by static antivirus engines.

Its code is heavily obfuscated, using randomized identifiers and a base64-plus-XOR (key 0x94) scheme to hide strings containing attacker infrastructure and payload URLs.

The downloader uses .NET’s RuntimeInformation APIs to detect OS and architecture, then fetches one of three payloads from cdn.zoom.com[.]kg, tailored for macOS ARM64, macOS Intel, or Windows x64. Each request includes a randomly generated 6-character token; requests lacking it return HTTP 401.

On execution, the malware drops the stage-2 payload to /tmp/ZoomMeetings, launches it via a backgrounded nohup process to survive parent termination, and simultaneously downloads the legitimate Zoom installer to maintain the ruse displaying “Zoom Meetings Installed” regardless of payload success.

The second stage is a Mach-O ARM64 binary built from Overlord, an open-source, WebSocket-based cross-platform RAT, compiled with garble obfuscation that defeated tools like GoReSym. This build hardcodes its C2 as hub.zoom.com[.]kg:5173 and disables TLS certificate validation (TLSInsecureSkipVerify: true).

Overlord’s capabilities include keylogging, screen and webcam capture, microphone access, full filesystem control, process management, multi-language script execution, a native/WASM plugin loader, self-update, remote desktop streaming, and an optional Solana blockchain-based C2 resolver, though this sample relies on a hardcoded address rather than on-chain resolution.

Persistence via LaunchAgent is gated by an OVERLORD_ENABLE_PERSISTENCE flag; it did not trigger in the primary sample but fired immediately in a second variant, which installed a LaunchAgent at ~/Library/LaunchAgents/com.zoom.plist.

Jamf Threat Labs noted overlaps with FlexibleFerret, a DPRK-attributed malware family tied to the Contagious Interview campaign, sharing the identical com.zoom LaunchAgent label.

Overlord has also previously surfaced in campaigns linked to UNK_DeadDrop, a cluster Proofpoint assesses as likely North Korean. Jamf has not formally attributed this specific campaign to any actor.

This campaign marks the first observed use of .NET as a macOS malware downloader, joining Go and Rust as cross-platform tooling choices for threat actors. Jamf recommends enabling threat prevention and web protection controls to block execution of similar payloads.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR