Threats Tagged 'overlord'

A sophisticated macOS campaign has been discovered using a fake Zoom installer to deploy Overlord RAT, an open-source remote access framework. The attack employs a .NET-based downloader disguised as ZoomMeetings, representing an uncommon approach for macOS threats. The multi-stage attack fingerprints the victim's system to deliver platform-specific payloads for macOS ARM64, macOS Intel, or Windows from attacker-controlled infrastructure. The second stage deploys Overlord RAT with extensive capabilities including keylogging, screen capture, audio and webcam access, filesystem manipulation, and remote desktop streaming. The malware communicates with command-and-control servers over encrypted WebSockets and maintains persistence through LaunchAgents. The campaign shares characteristics with previous North Korean operations, including similarities to FlexibleFerret malware and the Contagious Interview campaign.

Between April and May 2026, a likely North Korean threat actor conducted phishing campaigns targeting developers across nearly 100 organizations in finance, cryptocurrency, education, and technology sectors. The attacks used recruitment and code review themes, delivering emails with links to actor-controlled GitHub repositories hosting malicious scripts. The infection chain exploited Visual Studio Code workflows and deployed malicious Visual Studio Extensions (VSIX) requiring minimal user interaction. Cross-platform malware was executed on macOS, Linux, and Windows systems, including the open-source Overlord framework. The campaigns specifically targeted developer assets including API tokens, cryptocurrency wallets, and credentials. Attackers employed fake company personas and professional-looking repositories masquerading as legitimate cryptocurrency and blockchain projects to establish credibility and lure victims.

MediumMalwareUnited States#wallet exfiltration#ottercookie#cryptocurrency theft