2026-08-07 · view entry permalink →
A fake Zoom installer stages Overlord RAT through the first .NET macOS downloader Jamf has observed — PE-format DLLs bundled inside a Mach-O binary
Jamf Threat Labs found a counterfeit Zoom installer that introduces a runtime macOS malware has not used before as a downloader stage. "The downloader is a macOS ARM64 Mach-O binary named ZoomMeetings, built as a self-contained .NET 10 single-file application with the .NET runtime bundled inside" (Jamf Threat Labs, 2026-08-06). The choice is not cosmetic: recent macOS families have leaned on Go and Rust, and Jamf's point is portability — ".NET now joins that list, with its cross-platform support enabling a single codebase to target both Windows and macOS" (Jamf Threat Labs, 2026-08-06). The structural quirk that makes it interesting to a reverser is that .NET assemblies carry their intermediate-language bytecode in the Windows PE container even when hosted inside a Mach-O wrapper, so a macOS binary here contains Windows-format executables: static analysis extracted 34 embedded PE/DLL files from the wrapper. One of them carries plaintext Zoom product-metadata strings lifted from the legitimate installer so casual inspection reads as genuine, while the malicious DLL's method, field and string-table names are obfuscated into generated identifiers.
Execution writes a stage-two binary into a temporary directory and launches it backgrounded and detached from the terminal session, so the payload outlives the installer. It then does the thing that makes this hard to triage. Jamf: "Concurrently, it fetches the real Zoom installer to maintain the lure. On macOS it downloads the .pkg; on Windows the .exe" — retrieved from Zoom's own download host — with the consequence that "By the time anything suspicious happens on the machine, Zoom is installed and working" (Jamf Threat Labs, 2026-08-06). A user who checks whether they actually got Zoom will find that they did. That second stage is a Go build of Overlord, an openly available remote-access framework, compiled with Garble — which mangles the function, type and package names in Go's pclntab and obfuscates the moduledata structure that analysis tooling uses to locate them, breaking the standard Go reverse-engineering workflow that normally recovers a Go binary's symbol layout for free. "The agent connects to its C2 over a secure WebSocket" (Jamf Threat Labs, 2026-08-06), reaching a Zoom-branded lookalike host on a non-standard port. Overlord's capability set is broad — keylogging, screen, audio and webcam capture, filesystem access and arbitrary script execution — with optional LaunchAgent persistence. Jamf sets out two separate points of similarity and declines to draw a conclusion from either. Overlord was also used by UNK_DeadDrop, a cluster Proofpoint assesses as likely North Korean, though Jamf states no direct overlap has been identified between that activity and this campaign; and this Overlord variant shares its LaunchAgent label and plist name with FlexibleFerret, a DPRK-attributed macOS family associated with the Contagious Interview campaign and documented by SentinelOne in February 2025. Jamf's own position is that it has noted the similarities but does not currently attribute this malware to a specific threat actor, and the initial delivery vector remains under investigation — so on the evidence published this is an unattributed campaign reusing a public tool, and the DPRK-adjacent context is a naming and tooling overlap rather than an attribution.
The downloader is a macOS ARM64 Mach-O binary named ZoomMeetings, built as a self-contained .NET 10 single-file application with the .NET runtime bundled inside.
.NET now joins that list, with its cross-platform support enabling a single codebase to target both Windows and macOS.
The agent connects to its C2 over a secure WebSocket.
By the time anything suspicious happens on the machine, Zoom is installed and working.