A Q3 2026 Kaspersky threat report says researchers found the Overlord macOS backdoor being distributed as fake Zoom installers. The report does not describe the delivery channel or exact wording, but the lure is clear: users seeking Zoom software could be tricked into installing spyware that can access their microphone, camera, screen, and keystrokes.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Need Zoom on your Mac? A fake installer could be spyware. Jamf researchers found fake Zoom installers spreading Overlord. You download it from a website, run it, and the supposed meeting app can access your microphone, camera, screen, and keystrokes. Here's the giveaway: the download isn't from Zoom's official site or your company software tool, and the installer wants sweeping permissions. That's not a routine update. Before installing Zoom on your Mac, get it through your approved company software tool.
Researchers say the Iran-linked group Nimbus Manticore posed as recruiters on LinkedIn and job platforms to send developers “technical challenge” ZIP files that secretly installed cross-platform remote access trojans. The lures used urgency (short test windows) and realistic developer workflows…
Researchers observed a coordinated social-engineering operation (“Spring Ring”) where attackers used external Microsoft Teams accounts to pose as internal IT help desk staff and start voice calls. Victims were pressured to install remote-control tools (like Quick Assist or other RMM software) or…
This weekly roundup includes real-world social engineering campaigns, including scammers mailing fake IRS letters to cryptocurrency holders and a phishing campaign impersonating Bank of America. The lures are designed to pressure victims into visiting a bogus compliance portal or installing remote…
A real developer-targeted campaign used a fake “Google Update Support” extension hidden in weaponized code repositories. Victims were lured with a paid, no-coding-needed request to review a project in Cursor; opening the repository could trigger installation of an extension that collected browser,…
Iran-aligned DarkBlinders used convincing recruitment offers while posing as Dubai Airports recruiters to target a high-value job seeker in Iraq. The victim was asked to complete what appeared to be a coding assessment, but the assessment package installed malware. The group also used lookalike…
A phishing campaign impersonated a U.S. federal court and targeted more than 100,000 businesses with fake Alternative Dispute Resolution notices. Victims who followed the link reached a personalized fake court portal and were urged to download an archive that installed remote-access malware capable…
