Press play to start listening
Cybersecurity researchers at Jamf Threat Labs recently published their latest research findings regarding a campaign using a cross-platform downloader capable of delivering Overlord RAT to macOS and Windows devices.
As per Jamf’s investigation, in this campaign, attackers are distributing an open-source remote access trojan (RAT) called Overlord RAT. The malware is delivered through a fake Zoom installer that also downloads the genuine Zoom application to maintain the deception.
The Overlord framework supports keylogging, screen streaming, microphone and webcam access, file management, process control, command execution, plugins, self-updates and remote desktop access. Jamf documented these functions in the framework but did not report observing attackers use every capability.
Analysis and Attack Methods
Researchers discovered the initial downloader (ZoomMeetings) on VirusTotal. The software checks the target machine’s architecture using system APIs, then requests tailored secondary payloads from web servers like cdn.zoom.com.kg. Each request includes a randomly generated six-character ts= parameter. The server returned an HTTP 401 response when researchers requested a payload without it.
The downloader’s code is obfuscated, with strings encoded in Base64 and then decoded using an XOR operation with the numeric key 0x94. Jamf said the sample was undetected by VirusTotal’s static scanners when examined.
A second .NET downloader named ZoomInstallerFull was also found, exposing a developer path referencing the username ollie and project name TheEgg. Unlike the obfuscated build, its strings appeared in plaintext.
During the observed execution process, the downloader saved the Overlord payload to /tmp/ZoomMeetings and launched it through a backgrounded nohup command. It also installed the genuine Zoom application and displayed “Zoom Meetings Installed” to maintain the deception.
Rare Use of .NET Code
Mac malware developers usually rely on programming languages like Go or Rust. This campaign is different because the downloader uses Microsoft’s .NET 10 framework bundled inside a native Mach-O executable file. Since .NET code runs across different operating systems, cyberattackers can target both macOS and Windows using one codebase.
Researchers extracted 34 DLL files stored in the Portable Executable format. Thirty-three were standard .NET runtime libraries, while the remaining malicious DLL contained the decoy labels “Zoom Communications, Inc” and “Zoom Meetings Installer.”
Server Connections and Hacker Links
The Overlord agent is written in Go and compiled with Garble obfuscation, which prevented GoReSym from recovering a valid function table. It connects to hub.zoom.com.kg:5173 through an encrypted WebSocket, but TLS certificate validation is disabled.
The malware also contains a Solana-based resolver capable of retrieving command-server addresses from blockchain transactions. Jamf found this function disabled in the examined build, with no wallet or RPC endpoint configured.
Past Connections
Overlord was previously used by UNK_DeadDrop, a cluster that Proofpoint assesses as likely North Korean. The com.zoom LaunchAgent label and plist name also match FlexibleFerret, malware linked to the Contagious Interview campaign. Jamf found no direct connection and did not attribute the new activity to any group.
