Fake Zoom Installer Uses:NET Downloader to Deploy Overlord RAT on macOS, Windows

A newly documented campaign is using a trojanized Zoom installer to plant a fully featured remote access trojan on Apple systems, and the delivery mechanism behind it marks a genuine shift in how macOS malware is engineered.

Jamf Threat Labs discovered the campaign after spotting a macOS ARM64 Mach-O file named Zoom meetings on VirusTotal, disguised as the legitimate Zoom client.

Unlike the Go- or Rust-based loaders that have dominated cross-platform Mac malware in recent years, this binary is a self-contained .NET 10 single-file application, meaning the entire .NET runtime is bundled inside a native Apple executable.

Fake Zoom Installer Uses

That’s an unusual pairing. .NET assemblies still use the Windows PE format internally, even when wrapped in a Mach-O shell for macOS, so researchers were able to extract 34 embedded DLLs by scanning for MZ header signatures.

One carried metadata mimicking a genuine Zoom installer, while the code itself was heavily obfuscated, with method names replaced by strings like __obf_proxy_0 and plaintext hidden behind base64-encoded, XOR-keyed string tables.

Once running, the downloader calls .NET’s RuntimeInformation APIs to detect the host operating system and CPU architecture, then pulls one of three payloads from attacker infrastructure hosted at cdn.zoom.com[.]kg, covering macOS ARM64, macOS Intel, and Windows x64.

Each request requires a randomly generated six-character token, and the server rejects requests without one, a small but deliberate anti-scanning measure.

To keep the ruse alive, the malware simultaneously fetches the genuine Zoom installer from Zoom’s own servers, so victims end up with a working video-conferencing app while the malicious payload runs quietly via a backgrounded nohup process in /tmp.

The second-stage payload is a Go binary built from Overlord, an open-source, cross-platform RAT hosted publicly on GitHub that communicates over encrypted WebSockets.

This particular build is compiled with the garble obfuscator, defeating standard recovery tools like GoReSym, and hardcodes a command-and-control address at hub.zoom.com[.]kg:5173 with TLS certificate validation disabled entirely.

Overlord’s capability set is extensive: system-wide keylogging, screen and webcam capture, microphone recording, full filesystem control, remote script execution across bash, Python, Ruby, Node, Perl, and PowerShell, a plugin loader for native or WebAssembly modules, and even a Solana blockchain-based C2 resolver (unused in this build).

Persistence via a LaunchAgent is opt-in but appeared active in a related sample, which installed itself under a com.zoom.plist label — notably the same naming convention used by FlexibleFerret, a DPRK-linked malware family tied to the Contagious Interview campaign.

Jamf Threat Labs stops short of attributing the campaign to a specific actor, though it notes that Overlord has previously surfaced in UNK_DeadDrop activity that Proofpoint assessed as likely North Korean. No direct infrastructure overlap has been confirmed here.

The real headline isn’t the RAT itself; it’s the delivery language. Threat actors have steadily adopted Go and Rust to write malware once and deploy it everywhere; NET’s cross-platform runtime now offers the same efficiency, and its legitimate use in enterprise software makes obfuscated variants easier to overlook.

Security teams evaluating Mac endpoints should treat unsigned or newly surfaced installer binaries, even convincing ones, with heightened scrutiny, and enable web and execution protections capable of blocking connections to newly registered lookalike domains.