Yesterday I posted that links scammers send through Telegram stopped opening on Apple devices. Today I think I know why.

Security researchers found NimDoor, macOS malware built in North Korea that pretends to be Zoom. It targets people who work in Web3 and spreads through Telegram as fake Zoom invites. It is put together from:

- AppleScript
- Bash
- C++
- Nim

And it uses:

- encrypted communication over WebSocket with TLS (wss)
- a persistence mechanism that restores and restarts its parts after installation or a reboot

The AppleScript handles first access and works as a beacon that reports home. A Bash script steals data from the keychain, browsers and mail.

The browsers its `trojan1_arm64` component goes after:

- Arc
- Brave
- Firefox
- Chrome
- Edge

## How they reach you

The easiest way is Telegram, which has become a kind of heir to the darknet. However much Durov tightens things, scams and illegal trading still thrive there. Thanks, free speech.

The approach is the one we already know. Someone says they know you, or that you should talk, and suggests booking a Zoom call through Calendly. Everything looks normal. Then they send a link with instructions to install a "zook SDK update", which is a fake copy of Zoom. ("Zook" is probably a deliberate misspelling, or a way to slip past filters.)

The installer script is padded with more than 10,000 blank lines to hide what it does. Once the fake app runs, it:

- opens an encrypted channel to its command server,
- sets up mechanisms that restore its own components,
- starts scripts that collect private data and send it to the attackers' servers.

According to SentinelLabs, these techniques combine and improve on tricks North Korean groups have used before.

At the end, the code downloads and runs commands from servers on domains like `.forum`, `.cloud` and `.online`, dressed up as Zoom domains that don't exist. Real Zoom links are on `zoom.us`.

The fake "Zoom" is also about 200 MB bigger than the real one. If you are paying attention at all, that is where you catch it.

Best advice, on Telegram and everywhere else: don't open links from strangers, and don't hand your personal data to anyone.