Mac users are the target of a new attack that hides a remote access trojan inside what looks like an installer for a popular video meeting app. Security firm Jamf Threat Labs found the downloader, named ZoomMeetings, is a self-contained .NET 10 binary for Apple silicon that also works on Windows.
The researchers said the sample escaped detection by static engines on VirusTotal when they analyzed it, and that the use of .NET as a macOS downloader is a technique they had not previously observed in campaigns of this kind.
The downloader checks which operating system and chip it is running on, then fetches one of three payloads from attacker-controlled infrastructure. On a Mac it saves the second stage to /tmp/ZoomMeetings and launches it in the background while a genuine Zoom installer downloads at the same time, so the machine ends up with a working copy of the app.
That second stage is built from Overlord, an open-source framework that talks to its command server over encrypted WebSockets. It can log keystrokes, capture the screen, microphone and webcam, run scripts, browse and exfiltrate files, and even stream the desktop to the operator.
Persistence is optional in this build, though a second sample installed a LaunchAgent under the com.zoom label and pulled the Mac’s serial number and hardware UUID. Jamf said the label matches FlexibleFerret, a family tied to North Korean Contagious Interview attacks, but stopped short of attributing this campaign to any group.
