North Korean (DPRK) threat actors, specifically linked to the FlexibleFerret malware family, are targeting macOS environments through fraudulent Zoom and Google Chrome installers. The campaign leverages a novel .NET-based downloader on macOS to facilitate the deployment of the Overlord Remote Access Trojan (RAT). By utilizing sophisticated social engineering, including deepfake-enhanced video calls, the actors bypass Gatekeeper and macOS security prompts to establish persistence via LaunchAgents and LaunchDaemons. Once installed, the Overlord RAT provides full remote command execution, credential harvesting, and systematic file exfiltration, demonstrating a strategic shift toward using cross-platform frameworks to compromise high-value Unix-based endpoints.

• Threat Attribution: Social Engineering and Intelligence Gathering

  • Attribution is linked to DPRK-sponsored actors, specifically the FlexibleFerret malware family.
  • Use of advanced social engineering, including deepfake audio/video in Zoom calls, to impersonate interviewers.
  • Targeting of high-value personnel, including software developers and corporate executives, to facilitate espionage.

• Attack Vector: Delivery and Execution Mechanisms

  • Distribution of spoofed .dmg and .pkg installers masquerading as legitimate Zoom and Google Chrome software updates.
  • Deployment of a novel .NET-based downloader architected specifically to operate within macOS environments.
  • Exploitation of user manipulation to bypass macOS Gatekeeper and security warnings during the installation process.

• Technical Analysis: Overlord RAT Capabilities

  • Deployment of the Overlord Remote Access Trojan (RAT) following successful execution of the .NET downloader.
  • Establishment of persistent access through macOS-specific mechanisms, including LaunchAgents and LaunchDaemons.
  • Full-spectrum exploitation capabilities, including remote shell access, credential theft, and automated file exfiltration.

• C2 Infrastructure and Systemic Impact

  • Command and Control (C2) communication is obfuscated and managed via the .NET downloader to maintain stealth.
  • Demonstrated pivot toward cross-platform frameworks to bypass traditional macOS-centric security detections.
  • High risk of long-term intellectual property theft and compromise of sensitive source code repositories.

• Defensive Actions: Detection and Mitigation

  • Implementation of strict monitoring for unauthorized .NET runtime activity and unusual process spawning on macOS.
  • Enforcement of application whitelisting to prevent the execution of unverified .app or .pkg installers.
  • Security awareness training specifically targeting deepfake-based social engineering and fraudulent recruitment lures.