Overlord RAT is an open-source, cross-platform Remote Access Trojan (RAT) delivered via a fake Zoom installer. A .NET downloader disguised as Zoom drops a garble-obfuscated Go agent that communicates over encrypted WebSockets, granting operators full remote control of the compromised device.

Symptoms

You might observe the following artifacts associated with this threat:

• Presence of /tmp/ZoomMeetings — a file not written by the legitimate Zoom installer.
• A newly created LaunchAgent at ~/Library/LaunchAgents/com.zoom.plist not associated with an official Zoom installation.
• An unexpected directory at ~/Library/Application Support/Overlord/.
• Outbound WebSocket connections to domains ending in .com[.]kg or .com[.]lv on port 5173.
• Zoom appearing to install without the user having initiated a download from an official source.
• Unexpected background processes such as keylogging, screen or webcam capture, or interpreter processes running without a corresponding user-initiated application.

Technical Breakdown

Overlord RAT is delivered through a two-stage infection chain initiated by a fake Zoom installer.

The first stage, ZoomMeetings, is a macOS ARM64 Mach-O binary built as a self-contained .NET 10 single-file application. Its strings are base64-encoded and XOR'd with the key 0x94 to conceal Command and Control (C2) infrastructure and payload URLs. The downloader detects the victim's operating system and architecture, fetches a platform-specific payload from attacker-controlled infrastructure, drops it to /tmp/ZoomMeetings, and launches it via nohup. The legitimate Zoom application is installed simultaneously to maintain the deception.

The second stage is a garble-obfuscated Go agent built from the open-source Overlord framework. It communicates over encrypted WebSockets to hub.zoom.com[.]kg:5173 with TLS certificate validation disabled. Persistence via LaunchAgent is gated by an OVERLORD_ENABLE_PERSISTENCE flag and was observed active in a second variant, which installed ~/Library/LaunchAgents/com.zoom.plist.

Some of Overlord's capabilities include:

• Keylogging
• Screen, webcam, and audio capture
• Remote desktop streaming
• Filesystem operations
• Process control
• Interpreter execution (Bash, Python, Ruby, Node, Perl, PowerShell)
• Plugin loading and self-update
• Solana blockchain-based C2 resolver

Next Steps

Iru Endpoint Detection & Response (EDR) automatically removes detected threats when file monitoring is set to Protect. While the malicious file is removed, it can leave behind artifacts that need to be cleaned manually:

• ~/Library/LaunchAgents/com.zoom.plist
• ~/Library/Application Support/Overlord/com.zoom
• /tmp/ZoomMeetings

In the future, download Zoom and all collaboration software exclusively from official vendor sources. Ensure that all applications are obtained from official and reputable sources to maintain device integrity and security.