A fake Zoom installer stages Overlord RAT through the first .NET macOS downloader Jamf has observed — PE-format DLLs bundled inside a Mach-O binary
Jamf Threat Labs found a counterfeit Zoom installer that introduces a runtime macOS malware has not used before as a downloader stage. "The downloader is a macOS ARM64 Mach-O binary named ZoomMeetings, built as a self-contained .NET 10 single-file application with the .NET runtime bundled inside" (Jamf Threat Labs, 2026-08-06). The choice is not cosmetic: recent macOS families have leaned on Go and Rust, and Jamf's point is portability — ".NET now joins that list, with its cross-platform support enabling a single codebase to target both Windows and macOS" (Jamf Threat Labs, 2026-08-06). The structural quirk that makes it interesting to a reverser is that .NET assemblies carry their intermediate-language bytecode in the Windows PE container even when hosted inside a Mach-O wrapper, so a macOS binary here contains Windows-format executables: static analysis extracted 34 embedded PE/DLL files from the wrapper. One of them carries plaintext Zoom product-metadata strings lifted from the legitimate installer so casual inspection reads as genuine, while the malicious DLL's method, field and string-table names are obfuscated into generated identifiers.
Execution writes a stage-two binary into a temporary directory and launches it backgrounded and detached from the terminal session, so the payload outlives the installer. It then does the thing that makes this hard to triage. Jamf: "Concurrently, it fetches the real Zoom installer to maintain the lure. On macOS it downloads the .pkg; on Windows the .exe" — retrieved from Zoom's own download host — with the consequence that "By the time anything suspicious happens on the machine, Zoom is installed and working" (Jamf Threat Labs, 2026-08-06). A user who checks whether they actually got Zoom will find that they did. That second stage is a Go build of Overlord, an openly available remote-access framework, compiled with Garble — which mangles the function, type and package names in Go's pclntab and obfuscates the moduledata structure that analysis tooling uses to locate them, breaking the standard Go reverse-engineering workflow that normally recovers a Go binary's symbol layout for free. "The agent connects to its C2 over a secure WebSocket" (Jamf Threat Labs, 2026-08-06), reaching a Zoom-branded lookalike host on a non-standard port. Overlord's capability set is broad — keylogging, screen, audio and webcam capture, filesystem access and arbitrary script execution — with optional LaunchAgent persistence. Jamf sets out two separate points of similarity and declines to draw a conclusion from either. Overlord was also used by UNK_DeadDrop, a cluster Proofpoint assesses as likely North Korean, though Jamf states no direct overlap has been identified between that activity and this campaign; and this Overlord variant shares its LaunchAgent label and plist name with FlexibleFerret, a DPRK-attributed macOS family associated with the Contagious Interview campaign and documented by SentinelOne in February 2025. Jamf's own position is that it has noted the similarities but does not currently attribute this malware to a specific threat actor, and the initial delivery vector remains under investigation — so on the evidence published this is an unattributed campaign reusing a public tool, and the DPRK-adjacent context is a naming and tooling overlap rather than an attribution.
The downloader is a macOS ARM64 Mach-O binary named ZoomMeetings, built as a self-contained .NET 10 single-file application with the .NET runtime bundled inside.
.NET now joins that list, with its cross-platform support enabling a single codebase to target both Windows and macOS.
The agent connects to its C2 over a secure WebSocket.
By the time anything suspicious happens on the machine, Zoom is installed and working.
ATT&CK mapping
14 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Execution TA0002
T1059.004Command and Scripting Interpreter: Unix Shell
Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.
T1204.002User Execution: Malicious File
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.
Persistence TA0003
T1543.001Create or Modify System Process: Launch Agent
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in <code>/System/Library/LaunchAgents</code>, <code>/Library/LaunchAgents</code>, and <code>~/Library/LaunchAgents</code>. Property list files use the <code>Label</code>, <code>ProgramArguments </code>, and <code>RunAtLoad</code> keys to identify the Launch Agent's name, executable location, and execution time. Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.
Privilege Escalation TA0004
T1543.001Create or Modify System Process: Launch Agent
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in <code>/System/Library/LaunchAgents</code>, <code>/Library/LaunchAgents</code>, and <code>~/Library/LaunchAgents</code>. Property list files use the <code>Label</code>, <code>ProgramArguments </code>, and <code>RunAtLoad</code> keys to identify the Launch Agent's name, executable location, and execution time. Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.
Stealth TA0005
T1027Obfuscated Files or Information
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
T1027.013Obfuscated Files or Information: Encrypted/Encoded File
Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file content aims to conceal malicious artifacts within a file used in an intrusion. Many other techniques, such as Software Packing, Steganography, and Embedded Payloads, share this same broad objective. Encrypting and/or encoding files could lead to a lapse in detection of static signatures, only for this malicious content to be revealed (i.e., Deobfuscate/Decode Files or Information) at the time of execution/use.
T1036.005Masquerading: Match Legitimate Resource Name or Location
Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.
Credential Access TA0006
T1056.001Input Capture: Keylogging
Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.
Collection TA0009
T1056.001Input Capture: Keylogging
Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.
T1113Screen Capture
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>, or <code>screencapture</code>.
T1123Audio Capture
An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information.
T1125Video Capture
An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files.
Command and Control TA0011
T1071.001Application Layer Protocol: Web Protocols
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
T1105Ingress Tool Transfer
Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).
T1571Non-Standard Port
Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
T1573Encrypted Channel
Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.