cosmo.ai

NimDoor: the fake Zoom update going after Mac users on Telegram

Yesterday I posted that links scammers send through Telegram stopped opening on Apple devices. Today I think I know why.

Security researchers found NimDoor, macOS malware built in North Korea that pretends to be Zoom. It targets people who work in Web3 and spreads through Telegram as fake Zoom invites. It is put together from:

  • AppleScript
  • Bash
  • C++
  • Nim

And it uses:

  • encrypted communication over WebSocket with TLS (wss)
  • a persistence mechanism that restores and restarts its parts after installation or a reboot

The AppleScript handles first access and works as a beacon that reports home. A Bash script steals data from the keychain, browsers and mail.

The browsers its trojan1_arm64 component goes after:

  • Arc
  • Brave
  • Firefox
  • Chrome
  • Edge

How they reach you

The easiest way is Telegram, which has become a kind of heir to the darknet. However much Durov tightens things, scams and illegal trading still thrive there. Thanks, free speech.

The approach is the one we already know. Someone says they know you, or that you should talk, and suggests booking a Zoom call through Calendly. Everything looks normal. Then they send a link with instructions to install a "zook SDK update", which is a fake copy of Zoom. ("Zook" is probably a deliberate misspelling, or a way to slip past filters.)

The installer script is padded with more than 10,000 blank lines to hide what it does. Once the fake app runs, it:

  • opens an encrypted channel to its command server,
  • sets up mechanisms that restore its own components,
  • starts scripts that collect private data and send it to the attackers' servers.

According to SentinelLabs, these techniques combine and improve on tricks North Korean groups have used before.

At the end, the code downloads and runs commands from servers on domains like .forum, .cloud and .online, dressed up as Zoom domains that don't exist. Real Zoom links are on zoom.us.

The fake "Zoom" is also about 200 MB bigger than the real one. If you are paying attention at all, that is where you catch it.

Best advice, on Telegram and everywhere else: don't open links from strangers, and don't hand your personal data to anyone.

sha256 cb5e1639162b719b8b0cff971af0dbd460fe44362ca46634c5ab2be482896b15