Fake Zoom Installer Delivers Overlord RAT on macOS

A sophisticated macOS campaign has been discovered using a fake Zoom installer to deploy Overlord RAT, an open-source remote access framework. The attack employs a .NET-based downloader disguised as ZoomMeetings, representing an uncommon approach for macOS threats. The multi-stage attack fingerprints the victim's system to deliver platform-specific payloads for macOS ARM64, macOS Intel, or Windows from attacker-controlled infrastructure. The second stage deploys Overlord RAT with extensive capabilities including keylogging, screen capture, audio and webcam access, filesystem manipulation, and remote desktop streaming. The malware communicates with command-and-control servers over encrypted WebSockets and maintains persistence through LaunchAgents. The campaign shares characteristics with previous North Korean operations, including similarities to FlexibleFerret malware and the Contagious Interview campaign.

• Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal CryptocurrencyMalware2026-06-08
• How VBScript Malware Evades Detection Using Trusted Tools CopyMalware2026-10-27
• Anatomy of BraZetsu: How Cybercriminals Supply the Underground EcosystemMalware2026-10-02
• New RemControl Android Banking Trojan Steals PINs Using AI-Built Phishing OverlaysMalware2026-09-24
• ChainScript: Tracing a Node.js RAT Through the BlockchainMalware2026-09-18