Threat Summary
Two concurrent intrusion patterns stand out in the latest pulses. First, a cross-platform malware delivery operation is using a fake Zoom installer branded as ZoomMeetings to fingerprint victims and deliver platform-specific payloads for macOS ARM64, macOS Intel, and Windows. On macOS the chain deploys Overlord RAT with FlexibleFerret-linked tooling, using a .NET downloader uncommon for Apple-targeted operations, Go-style obfuscation, LaunchAgent persistence, and WebSocket C2. Second, UNC6671 continues data-theft extortion despite the claimed May 2026 retirement of the BlackFile brand, rotating through Redact, Pink, Helix, and Falcon fronts while calling employees on personal mobile phones, impersonating IT helpdesk staff, and steering users to spoofed Okta/passkey SSO portals for credential and session theft.
Collectively, the activity shows a practical intrusion economy: social engineering and brand impersonation provide initial access, SaaS identity control planes are abused for cloud data access, and endpoint RAT tooling provides durable hands-on access where malware is used. The objective is extortion-ready access: steal credentials or sessions, reach enterprise SaaS and cloud repositories, exfiltrate sensitive files, then monetize through rebranded leak fronts. Treat any ZoomMeetings download outside approved software channels and any unsolicited helpdesk passkey/SSO reset call as high-fidelity precursors.
Threat Actor / Malware Profile
Overlord is an open-source remote access framework observed here as the final macOS payload, paired with FlexibleFerret-related delivery components. Distribution relies on trojanized collaboration software: a fake Zoom installer and lookalike meeting infrastructure such as hub.zoom.com.lv and hub.zoom.com.kg. The .NET downloader masquerades as ZoomMeetings, fingerprints architecture and OS, then selects the correct payload, which reduces noisy failed executions and enables one lure to serve macOS ARM64, Intel, and Windows victims.
Payload behavior centers on remote control, collection, and staged follow-on deployment. Reported host artifacts include LaunchAgent persistence, obfuscated Go/.NET components, cross-platform payload selection, and WebSocket C2 for interactive tasking. WebSocket C2 can blend with modern web traffic and proxy through legitimate TLS inspection gaps, so defenders should prioritize process ancestry, unsigned or ad-hoc signed binaries in user-writable paths, LaunchAgents with misleading labels, and outbound connections from unexpected user-space processes.
UNC6671 is an extortion operator rather than a single malware family. The current campaign relies on vishing to personal mobiles, helpdesk impersonation, spoofed Okta/passkey enrollment portals, adversary-in-the-middle credential/session capture, SaaS exfiltration, and multi-brand leak pressure. The indicators are infrastructure-heavy: domains such as oktaenroll.com, idokta.com, myoktasso.com, mypasskeysso.com, setupssopasskey.com, passkeyms.com, keyokta.com, and portalpasskey.com are built to look like enrollment, passkey setup, and SSO maintenance. Expect anti-analysis through short-lived domains, convincing TLS, MFA fatigue or session-token theft, and deletion or rotation of extortion branding.
IOC Analysis
This pulse set is dominated by hostname and domain indicators plus SHA256 file hashes. The Zoom typosquats hub.zoom.com.lv and hub.zoom.com.kg should be blocked at DNS, secure web gateway, TLS SNI inspection where lawful, and EDR network connection rules; also search proxy and DNS logs retrospectively for exact and subdomain matches. The UNC6671 domains are phishing and AiTM infrastructure, so operationalize them in email security, web proxy, IdP sign-in analytics, threat intel match rules, and browser isolation policies. Do not rely only on exact domains: add fuzzy detections for strings such as okta, passkey, sso, enroll, setup, and my-okta-like patterns in newly registered domains.
File hashes should be pushed to EDR block lists and used for retrohunts across endpoint telemetry, MDM software inventory, email attachment detonation, and download caches. Hashes are brittle against repacked Go and .NET binaries, so pair them with behavior: ZoomMeetings or Zoom update processes launching from user directories, curl/osascript/dotnet children, LaunchAgent writes, and unexpected WebSocket clients. Tooling that decodes or enriches these indicators includes OTX pulsereviews, VirusTotal and Hybrid-Analysis for hash context, urlscan.io for phishing pages, DNSDB/PassiveTotal for infrastructure pivots, Jamf Protect or Apple Endpoint Security telemetry for macOS, and Sentinel/Defender for identity and endpoint correlation.
Detection Engineering
Use the Sigma set for endpoint and network behaviors common to the fake Zoom macOS chain and identity-phishing follow-on access. Tune paths to your fleet naming and approved software distribution.
---
title: Fake Zoom Installer LaunchAgent Persistence macOS
id: 8b2f3d4e-4b6f-4a5c-9d2e-otxzoom0001
status: experimental
description: Detects suspicious LaunchAgent persistence created by user-level Zoom/ZoomMeetings impersonation processes associated with fake installer delivery of Overlord RAT.
author: Security Arsenal
date: 2026/09/06
logsource:
product: macos
category: file_event
detection:
selection_path:
TargetFilename|contains:
- '/Library/LaunchAgents/'
- '~/Library/LaunchAgents/'
selection_name:
TargetFilename|contains:
- 'zoom'
- 'zoommeetings'
- 'meet'
filter_approved:
TargetFilename|contains:
- 'us.zoom.xos'
- 'zoom.us'
condition: selection_path and selection_name and not filter_approved
falsepositives:
- Managed Zoom deployments via MDM
level: high
tags:
- attack.persistence
- attack.t1543.001
---
title: Suspicious WebSocket C2 From User Space Meeting Process
id: 8b2f3d4e-4b6f-4a5c-9d2e-otxzoom0002
status: experimental
description: Detects unexpected processes with Zoom-themed names making outbound WebSocket-like TLS connections to rare hosts, consistent with Overlord RAT C2.
author: Security Arsenal
date: 2026/09/06
logsource:
category: network_connection
detection:
selection_img:
Image|contains:
- 'ZoomMeetings'
- 'zoom'
- 'dotnet'
- 'curl'
- 'osascript'
selection_dst:
DestinationHostname|contains:
- 'hub.zoom.com.lv'
- 'hub.zoom.com.kg'
filter_ports:
DestinationPort:
- 443
condition: selection_img and (selection_dst or not filter_ports)
falsepositives:
- Legitimate Zoom auto-update if signed and MDM deployed
level: high
tags:
- attack.command_and_control
- attack.t1071.001
---
title: Okta Passkey SSO Phishing Domain Access
id: 8b2f3d4e-4b6f-4a5c-9d2e-otxunc0003
status: experimental
description: Detects endpoint or proxy access to UNC6671-style spoofed Okta, passkey, and SSO enrollment domains used in vishing-driven AiTM credential theft.
author: Security Arsenal
date: 2026/09/06
logsource:
category: dns
detection:
selection_exact:
query|contains:
- 'oktaenroll.com'
- 'idokta.com'
- 'myoktasso.com'
- 'mypasskeysso.com'
- 'setupssopasskey.com'
- 'passkeyms.com'
- 'keyokta.com'
- 'portalpasskey.com'
selection_tokens:
query|contains:
- 'passkey'
- 'okta'
- 'sso'
- 'enroll'
condition: selection_exact or (selection_tokens and query|endswith: '.com')
falsepositives:
- Internal IdP test domains; maintain an allowlist
level: medium
tags:
- attack.initial_access
- attack.phishing
- attack.t1566
- attack.t1656
Hunt in Microsoft Sentinel and Defender across endpoint process, network, and identity-adjacent events for the named infrastructure and suspicious Zoom/SSO behavior.
let ZoomBadHosts = dynamic(['hub.zoom.com.lv','hub.zoom.com.kg']);
let PhishBadDomains = dynamic(['oktaenroll.com','idokta.com','myoktasso.com','mypasskeysso.com','setupssopasskey.com','passkeyms.com','keyokta.com','portalpasskey.com']);
union isfuzzy=true
(DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any (ZoomBadHosts, PhishBadDomains) or RemoteIP in ()
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, ActionType),
(DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName has_any ('ZoomMeetings','dotnet','curl','osascript') or ProcessCommandLine has_any ('LaunchAgents','zoom.com.lv','zoom.com.kg','passkey','oktaenroll')
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, FolderPath, SHA256, InitiatingProcessFileName),
(SecurityEvent
| where TimeGenerated > ago(14d)
| where EventID in (4624,4625)
| where IpAddress has_any ('') or WorkstationName has_any ('')
| project TimeGenerated, Computer, Account, IpAddress, LogonType, Status, SubStatus)
| order by TimeGenerated desc
Run this bash hunter on macOS endpoints from MDM or an IR shell to surface LaunchAgent persistence, fake Zoom payloads, known hashes, and suspicious network state without changing the system.
#!/usr/bin/env bash
set -u
OUT="overlord_unc6671_hunt_$(date +%Y%m%d_%H%M%S).txt"
{
echo '[+] LaunchAgents containing zoom/meet/passkey/okta tokens'
find "$HOME/Library/LaunchAgents" /Library/LaunchAgents -maxdepth 1 -type f 2>/dev/null | egrep -i 'zoom|meet|passkey|okta|sso|update'
echo '[+] User-writable ZoomMeetings/fake installer candidates'
find "$HOME/Applications" "$HOME/Downloads" /Applications -maxdepth 4 \( -iname '*zoom*' -o -iname '*meet*' \) 2>/dev/null
echo '[+] Known pulse SHA256 present in common caches'
for h in 2c0bb97632bb9b90ee97be2ac350a557b08d84a7dad1f3ef63ffd83be1ab1f00 527f730d4ed6e9e23a971081f9e06691ac6e980bd06bb0b5f1091051d4631c5d 5334c468f0ffd5899a949ac3e0bc4665f80c658cb46e1a972df4e4ba0bb905f8 7878031f2bd907e7300133b3e8ce640f3cdcba56686eaca3539d4c22773bc233 7a2318127cabf28552a8aeed14a8445c8f36fbda5e57d8b122cf6f1c6b51a522 9d8948e64f75c203e28f90f5bd7678dde6bd351c7507eecdaaeab2fbe4ec43bb; do
grep -Rqs "$h" "$HOME/Library/Caches" /tmp 2>/dev/null && echo "HASH_HIT $h"
done
echo '[+] Established outbound connections from zoom/dotnet/curl/osascript-like processes'
lsof -nP -iTCP -sTCP:ESTABLISHED 2>/dev/null | egrep -i 'zoom|dotnet|curl|osascript|node|python'
echo '[+] DNS cache hints for pulse infrastructure'
dscacheutil -cachedump -entries host 2>/dev/null | egrep -i 'hub.zoom.com.lv|hub.zoom.com.kg|oktaenroll|idokta|myoktasso|passkey|setupssopasskey|portalpasskey'
} | tee "$OUT"
echo "Saved: $OUT"
Response Priorities
Immediate: block hub.zoom.com.lv, hub.zoom.com.kg, and all listed UNC6671 domains at DNS, proxy, email, and IdP conditional access where possible; push SHA256 hashes to EDR prevention; isolate endpoints with ZoomMeetings execution outside managed paths; capture LaunchAgents, installer PKG/DMG artifacts, browser downloads, and network connections before remediation. Search IdP logs for sign-ins, MFA changes, passkey enrollments, and new sessions following any call claiming to be IT support.
24h: force identity verification for impacted users using out-of-band channels from corporate directories, not caller-provided links; revoke active sessions, refresh tokens, OAuth grants, passkeys, and app passwords; rotate credentials for users who visited spoofed SSO pages; review SaaS audit logs for mass download, external sharing, mailbox rules, cloud storage sync, and unusual data export. Confirm whether phishing-resistant MFA was bypassed via session theft rather than weak factors.
1 week: harden architecture by restricting software installs to MDM-signed packages, blocking LaunchAgent writes by standard users where feasible, requiring notarized and organization-approved Zoom clients only, enabling Apple Endpoint Security or equivalent telemetry, alerting on new passkey/MFA enrollment plus impossible travel or new device, applying conditional access token protection, and running a vishing drill for helpdesk impersonation. Update procurement and support scripts so employees can verify real IT reset workflows.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.