Overlord
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The infection chain begins with emails containing links to actor-controlled GitHub repositories hosting malicious scripts that result in the execution of cross-platform malware for macOS, Linux, and Windows, including an open-source Go framework named Overlord.
Techniques & procedures
34 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Between April and May 2026, Proofpoint Threat Research observed a likely North Korean threat actor conducting phishing campaigns using developer role recruitment or code review themes... The infection chain begins with emails containing links to actor-controlled GitHub repositories...
Execution
10 techniques
Execution
The hidden tasks.json file defines a task with runOptions.runOn: "folderOpen", a VS Code feature that executes the task automatically when the folder is opened in the editor.
The task definition specifies the platform-specific commands that will be executed when the task runs: Linux/macOS: /bin/bash vendor/run-update.sh Windows: wscript.exe //B //Nologo vendor/run-update-hidden-launch.vbs
The tasks.json file launches run-update-hidden-launch.vbs via wscript.exe //B (hidden window), which calls run-update.cmd.
The tasks.json file launches run-update-hidden-launch.vbs via wscript.exe //B (hidden window), which calls run-update.cmd.
Once Python is available, the credential stealer (detect_malware.py) is executed for each browser profile.
Unlike Linux/macOS, the Windows attack does not deploy a Go binary. It runs entirely as JavaScript inside the editor's Electron process using ELECTRON_RUN_AS_NODE=1...
The campaigns abused Visual Studio Code workflows and deployed a stealthy new technique using malicious Visual Studio Extensions (VSIX) that requires minimal user interaction.
Persistence
2 techniques
Persistence
Privilege Escalation
4 techniques
Privilege Escalation
The hidden tasks.json file defines a task with runOptions.runOn: "folderOpen", a VS Code feature that executes the task automatically when the folder is opened in the editor.
Every time the user opens VS Code or Cursor on macOS or Linux, the VSIX extension activates, checks whether the subsequent infection portions are already running, and re-launches them if not.
Stealth
5 techniques
Stealth
The initial launcher (run-update.sh) is a bash script with an embedded Base64-encoded payload... The CMD file decodes an embedded script... The three encrypted payloads are decrypted at runtime using the hardcoded AES-256-GCM key...
The loader installs a malicious VS Code extension (VSIX) masquerading as a legitimate Google service.
The infection chain finishes by deleting malicious payloads and directories from the cloned repository in an effort to clean up forensic artifacts, while maintaining persistence through the VSIX extension.
Credential Access
6 techniques
Credential Access
The Linux backdoor uses Zenity... to create a prompt to collect user credentials. ... a second embedded Mach-O binary named darwin-password-prompt creates a fake system dialogue to prompt the user to enter their password.
The credential theft uses a second embedded Mach-O binary named darwin-password-prompt that creates a fake system dialogue to prompt the user to enter their password... The Linux backdoor uses Zenity... to create a prompt to collect user credentials.
The threat actor added three custom modules: browserlogin (Chrome and Firefox credential theft)...
The payloads communicate with a hardcoded C&C server, enabling remote command execution, system reconnaissance, followed by exfiltration of browser wallet extensions, decrypted credentials...
Discovery
1 technique
Discovery
Collection
4 techniques
Collection
The payloads communicate with a hardcoded C&C server... followed by exfiltration of browser wallet extensions, decrypted credentials, and desktop wallets.
The Linux backdoor uses Zenity... to create a prompt to collect user credentials. ... a second embedded Mach-O binary named darwin-password-prompt creates a fake system dialogue to prompt the user to enter their password.
Command and Control
4 techniques
Command and Control
Once Overlord is running, it immediately establishes a persistent WebSocket connection to the C&C server at 23.137.105.75:5173.
After both phases are complete, the stolen data is uploaded to the C&C server at 23.137.105.75:5173 via HTTP POST.
IOCs tracked for this family
122 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.