Fake Zoom installer uses .NET downloader to deliver Overlord RAT on macOS

Summary

A macOS malware campaign is using a fake Zoom installer to distribute the Overlord Remote Access Trojan (RAT). The downloader is a distinctive .NET-based Mach-O binary capable of targeting both macOS and Windows systems. Once launched, it retrieves platform-specific payloads from attacker-controlled infrastructure.

Investigation

Jamf Threat Labs analyzed a Mach-O downloader named ZoomMeetings that contains obfuscated .NET code. The investigation found that the malware uses XOR encoding with the key 0x94 to conceal C2 infrastructure and payload URLs. The second stage delivers an Overlord agent compiled with garble obfuscation to complicate static analysis.

Mitigation

Organizations should deploy advanced threat prevention and web protection controls to block malicious downloads. Restricting execution of unsigned or unexpected binaries from /tmp/ is recommended. Security teams should also monitor for unauthorized LaunchAgent creation to detect and prevent persistence.

Response

If malicious activity is detected, the affected macOS endpoint should be isolated immediately to disrupt C2 communication. Investigators should search for unauthorized files in /tmp/ and ~/Library/Application Support/. Suspicious LaunchAgents, including entries such as com.zoom.plist, should be identified and removed.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary aims to deploy the Overlord RAT on a macOS workstation by masquerading as a Zoom update. After tricking the user into running a fake installer, the installer drops a stage-2 payload into a hidden-looking directory in the temporary folder: /tmp/ZoomMeetings. To ensure the malware continues to run even if the user closes the terminal session, the attacker executes the payload using the nohup utility. This behavior is intended to bypass simple signature checks by using a legitimate system utility (nohup) to launch a suspicious file in a writeable directory.

• Regression Test Script:

  #!/bin/bash
  # Overlord RAT Simulation Script
  
  # 1. Create the suspicious directory in /tmp
  TARGET_DIR="/tmp/ZoomMeetings"
  mkdir -p "$TARGET_DIR"
  
  # 2. Create a dummy malicious binary
  MALICIOUS_BIN="$TARGET_DIR/overlord_payload"
  echo "#!/bin/bash" > "$MALICIOUS_BIN"
  echo "echo 'Overlord RAT active' >> /tmp/overlord_status.log" >> "$MALICIOUS_BIN"
  chmod +x "$MALICIOUS_BIN"
  
  # 3. Execute the binary using nohup to trigger the detection rule
  echo "[+] Executing payload via nohup to trigger detection..."
  nohup "$MALICIOUS_BIN" > /dev/null 2>&1 &
  
  echo "[+] Simulation complete. Check SIEM for alerts."

• Cleanup Commands:

  # Remove the malicious directory and files
  rm -rf /tmp/ZoomMeetings
  rm /tmp/overlord_status.log