This threat involves a multi-stage malware campaign targeting macOS systems through a fake Zoom installer. The initial stage uses a .NET-based downloader masquerading as ZoomMeetings to identify the system architecture and deliver tailored payloads for macOS ARM64, macOS Intel, or Windows. The second stage installs Overlord RAT, which enables attackers to perform keylogging, screen capture, audio and webcam surveillance, filesystem operations, and remote desktop streaming. The malware maintains persistence using LaunchAgents and communicates with its command-and-control infrastructure over encrypted WebSocket connections. The campaign exhibits similarities to known North Korean malware operations, including FlexibleFerret and the Contagious Interview campaign. Indicators such as malicious domains, IP addresses, URLs, and file hashes are associated with this campaign. There is no vendor advisory or patch information available.

The Overlord RAT deployed by this campaign allows attackers to gain extensive remote access and control over infected macOS systems, including surveillance capabilities (keylogging, screen, audio, webcam capture), filesystem manipulation, and remote desktop streaming. This level of access can lead to significant data compromise, privacy violations, and potential further network intrusion. The campaign's persistence mechanism via LaunchAgents increases the difficulty of removal. No confirmed active exploitation in the wild has been reported to date.

No official patch or vendor advisory is available for this threat. Mitigation should focus on user awareness to avoid downloading software from untrusted sources, especially fake installers masquerading as legitimate applications like Zoom. Endpoint detection and response solutions should be updated to detect indicators of compromise such as the provided hashes, domains, and IP addresses. Monitoring for suspicious LaunchAgent entries and unusual WebSocket communications may help identify infections. As this is a malware campaign rather than a software vulnerability, standard patching does not apply.