Fake Zoom Installer Delivers Overlord RAT on macOS: Cross Platform Dotnet Downloader Staging a Go Based Remote Access Implant

Jamf Threat Labs analysed a macOS ARM64 Mach-O binary posing as a Zoom installer, undetected by antivirus engines at the time of discovery, and traced it to a two stage chain ending in an agent built on a publicly available Go remote access framework. How victims are brought to that first stage downloader is still under investigation. A second downloader closely related to it was recovered from the same infrastructure, and its build metadata retains a developer account name and internal project name from the machine it was compiled on.

The first stage is a self contained .NET application that bundles its own runtime and several dozen libraries, one of which carries the malicious logic. Its identifiers have been replaced with generated sequences, and the strings that would reveal its purpose are stored encoded under a single byte key so they resolve only at runtime. The downloader asks the platform runtime which operating system and processor architecture it is running on, then requests the matching payload from attacker controlled infrastructure, passing a short random token that the server requires before it will serve anything. Building on a cross platform runtime lets one codebase and one set of infrastructure serve both Windows and macOS targets. On macOS the payload is written to a temporary directory and launched in the background so it survives the downloader exiting, while the genuine Zoom package is fetched and run in parallel to keep the lure intact. The downloader tells the user it succeeded whether or not the payload actually ran.

The second stage is compiled with a Go symbol mangling tool that rewrites function, type, and package names in the runtime metadata Go binaries normally carry. One recovered variant establishes persistence on first run: it copies itself into a per user support directory under the user library and registers a per user launch agent so it starts at every login, then queries the platform hardware registry for the machine's universally unique identifier, serial number, and model to tag the victim. Command and control runs over an encrypted socket to a host whose name reads as a Zoom domain up to the point where the real registrable domain begins, on a high numbered port, with certificate validation disabled by default. The framework carries a resolver that can read its command and control address from a blockchain transaction rather than from a hardcoded value, and while the capability is present in the analysed sample it is switched off with no wallet or endpoint configured.

The agent's capability set covers system wide keystroke capture, display capture with frame streaming, microphone and camera capture, enumeration of processor, memory, battery, operating system version, architecture, and administrative status, full filesystem read and write including upload, download, and archiving, process listing and control, command execution through whichever interpreters the host already provides, remote desktop streaming over the same socket or a peer to peer channel, replacement of its own binary on instruction, and loading native libraries or portable bytecode modules supplied by the operator at runtime. Jamf records overlap with previously reported North Korea linked macOS activity, specifically the launch agent naming used by an earlier fake conferencing application family, and notes similarity to reporting on interview themed lure campaigns. No actor attribution is asserted.