Post

🚨 New macOS backdoor alert: North-Korean hackers are disguising a Zoom update that drops malware built to hijack laptops and steal data & passwords. If you or your devs run macOS, keep scrolling.👇

3/7/25, 5:18 pm6 reposts8 likes

The attacker pretends to be a trusted contact → DM on Telegram → Calendly invite → follow-up email with a Zoom link that tells victims to “run this update script.” It's been hyper successful and catching founders/devs off-guard

Matt Johansen

@mattjay.com

3 July 2025

That script (`zoom_sdk_support.scpt`) hides *10,000 blank lines* scroll forever, never see the payload. The last 3 lines fetch stage-2 from `support.us05web-zoom[.]forum` (notice the look-alike Zoom domain)

Matt Johansen

@mattjay.com

3 July 2025

Stage-2 drops two binaries in /private/var/tmp • `a` (C++) - kicks off data-stealing chain • `installer` (Nim) - sets up persistence via signal handlers so killing the process re-installs the backdoor on reboot.

Matt Johansen

@mattjay.com

3 July 2025

Nasty little persistence trick - malware revives itself when killed. It intercepts `SIGINT` / `SIGTERM`, then rewrites LaunchAgents on shutdown. "any user-initiated termination of the malware results in the deployment of the core components, making the code resilient to basic defensive actions."