A malware campaign used a fake Zoom installer to deploy Overlord, an open-source remote access trojan (RAT), across both macOS and Windows systems. Community members who did not flag it as malicious (Source: Jamf) used .NET's RuntimeInformation APIs to detect the victim’s OS and architecture, fetching one of three platform-specific payloads (macOS ARM64, macOS Intel, or Windows) from attacker infrastructure at cdn.zoom.com[. ]kg, each request requiring a randomly generated token to avoid returning a 401 error.

Overlord's capabilities include system-wide keylogging, screen and webcam capture, microphone recording, full filesystem access, process control, remote script execution, a plugin loader for native or WebAssembly modules, self-updating, and remote desktop streaming.

Stage 2 payload host: cdn.zoom.com[. ]kg; resolves to 18.204.152[. ]241 Agent C2: hub.zoom.com[.

]kg; resolves to 18.204.152[. ]241 C2 agent previously resolved to 179.61.227[. ]46 File Path /tmp/ZoomMeetings Stage 2 payload, written by downloader File Path ~/Library/Application Support/Overlord/com.zoom Overlord variant, self-install path File Path ~/Library/LaunchAgents/com.zoom.plist Overlord variant, persistence via LaunchAgent SHA-256 7a2318127cabf28552a8aeed14a8445c8f36fbda5e57d8b122cf6f1c6b51a522 ZoomMeetings (.NET downloader, obfuscated build, macOS ARM64) SHA-256 d4cf150d6effeea315f136cdf448e32f4a8daac9e95f46def6a31ba18787dae3 ZoomInstallerFull (.NET downloader/dropper, earlier build, macOS ARM64) SHA-256 b5f1a21dcd315676a4a9217a40ef830c159121528114c6436e671c2fa5455681 a3d0b215f4541fbd0.dll (extracted payload DLL) SHA-256 527f730d4ed6e9e23a971081f9e06691ac6e980bd06bb0b5f1091051d4631c5d ZoomInstallerFull.dll (extracted payload DLL) SHA-256 2c0bb97632bb9b90ee97be2ac350a557b08d84a7dad1f3ef63ffd83be1ab1f00 ZoomMeetings (Overlord variant, macOS ARM64) SHA-256 9d8948e64f75c203e28f90f5bd7678dde6bd351c7507eecdaaeab2fbe4ec43bb ZoomMeetings (Overlord variant, macOS ARM64) SHA-256 5334c468f0ffd5899a949ac3e0bc4665f80c658cb46e1a972df4e4ba0bb905f8 ZoomMeetings (Overlord variant, macOS x64) SHA-256 7878031f2bd907e7300133b3e8ce640f3cdcba56686eaca3539d4c22773bc233 ZoomMeetings (Overlord variant, macOS ARM64)