Loading malware…
Overlord is an open-source, Go-based remote access framework used as a remote access trojan on Windows, macOS, and Linux. Its agents establish persistent WebSocket command-and-control connections and provide remote command execution, file management, system inspection, and extensibility through plugins. Capabilities vary between builds and operator modifications.
Windows builds support interactive remote desktop control, keyboard and mouse input, clipboard synchronization, screenshots, webcam and audio capture, and keystroke logging with window titles. Additional functionality includes file transfer, searching and archiving, process management, interactive terminals, SOCKS5 proxying, self-update, and removal. Some builds support hidden desktops, fake Windows Update displays, UAC bypass, in-memory DLL loading, and WebAssembly plugins. Persistence mechanisms include scheduled tasks, Run keys, and Windows Recovery Environment hooks. Certain builds resolve command-and-control addresses through Solana blockchain transactions; others use runtime-constructed server addresses and TLS-pinned WebSocket connections.
Overlord has been distributed through malicious npm packages in the MALFEX supply-chain campaign, where installation hooks download and execute Windows payloads. Separate Windows phishing operations have delivered it through financial-document lures and DLL-sideloading loaders that use anti-analysis checks, encrypted payloads, and process hollowing. These loader behaviors are distinct from the Overlord agent itself.
The UNK_DeadDrop campaign has deployed modified Overlord binaries against Linux and macOS developers through recruitment and code-review phishing emails linking to malicious GitHub and GitLab repositories. Repository task automation in Visual Studio Code and Cursor triggers execution, while a malicious editor extension provides persistence. Custom modules steal browser credentials, cryptocurrency wallet data, and operating-system keychain or keyring secrets, use deceptive password prompts, and remove attack artifacts. This activity has targeted cryptocurrency, financial services, technology, education, and other organizations, particularly in the United States. Overlord is used in multiple distinct operations and is not exclusive to a single threat actor.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Delivery Arm A downloads a Windows PE payload that ultimately executes a build of overlord-client, an open-source Go RAT. The recovered build includes a live Solana blockchain C2 resolver.
The malware deployed through this campaign is cross-platform, capable of running on macOS, Linux, and Windows. It leverages an open-source Go framework called Overlord to maintain persistent connections to a command-and-control server.
On Linux and macOS systems, the attacker leverages an open-source command-and-control (C2) framework called Overlord, deploying Go binaries with remote access trojan (RAT) capabilities that establish a persistent WebSocket connection to the attacker’s servers.
48 distinct techniques documented for this family, organized by ATT&CK tactic.
The server proxies signaling so the existing JWT auth + per-client RBAC still apply... Overlord supports generic OIDC login... Local username/password login stays enabled as a fallback.
The operator uploaded malicious npm packages; function-color pulls in function-flag, native-runner pulled in img-to-native, and cdn-img-fetch remained reachable after its parent package was seized.
Between April and May 2026, Proofpoint Threat Research observed a likely North Korean threat actor conducting phishing campaigns using developer role recruitment or code review themes... The infection chain begins with emails containing links to actor-controlled GitHub repositories...
The attack begins with a phishing email pointing to a GitHub or GitLab repository that mimics a real coding project. The emails look like job recruitment messages or code review requests...
The hidden tasks.json file defines a task with runOptions.runOn: "folderOpen", a VS Code feature that executes the task automatically when the folder is opened in the editor.
Defenders are advised to alert on persistence artifacts including the \Maiden scheduled task.
On macOS and Linux, the script installs a malicious VS Code extension (VSIX) disguised as a Google service, then launches the Overlord backdoor. ... On Linux, the malware uses ... Python scripts.
The tasks.json file launches run-update-hidden-launch.vbs via wscript.exe //B (hidden window), which calls run-update.cmd.
Linux/macOS: /bin/bash vendor/run-update.sh
The tasks.json file launches run-update-hidden-launch.vbs via wscript.exe //B (hidden window), which calls run-update.cmd.
Once Python is available, the credential stealer (detect_malware.py) is executed for each browser profile.
Unlike Linux/macOS, the Windows attack does not deploy a Go binary. It runs entirely as JavaScript inside the editor's Electron process using ELECTRON_RUN_AS_NODE=1...
The IExpress cabinet contains a signed AutoIt3 interpreter and encrypted script; defenders are advised to alert on %LOCALAPPDATA%\ScopeSmart Technologies Inc\AutoIt3.exe.
When a developer clones the repository and opens it in Visual Studio Code or Cursor, a hidden file called tasks.json inside a concealed .vscode folder automatically runs malicious scripts.
The campaigns abused Visual Studio Code workflows and deployed a stealthy new technique using malicious Visual Studio Extensions (VSIX) that requires minimal user interaction.
The instructions encouraged the target to clone the repository and open it in an editor such as VS Code or Cursor. A pre-configured task executes silently when the user opens the repository folder in the IDE...
A developer who receives what looks like a legitimate technical assignment email would likely clone a repository and open it in their code editor without a second thought, which is precisely where the attack begins.
The hidden tasks.json file defines a task with runOptions.runOn: "folderOpen", a VS Code feature that executes the task automatically when the folder is opened in the editor.
Defenders are advised to alert on persistence artifacts including the \Maiden scheduled task.
The server proxies signaling so the existing JWT auth + per-client RBAC still apply... Overlord supports generic OIDC login... Local username/password login stays enabled as a fallback.
On macOS and Linux, the script installs a malicious VS Code extension (VSIX) disguised as a Google service...
the malware leverages the password to extract browser credentials from Keychain and GNOME Keyring and subsequently relaunches itself as root to perform further Keychain and GNOME Keyring dumps.
Every time the user opens VS Code or Cursor on macOS or Linux, the VSIX extension activates, checks whether the subsequent infection portions are already running, and re-launches them if not.
It writes HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate_<4> pointing at ExplorerBroker.exe.
The hidden tasks.json file defines a task with runOptions.runOn: "folderOpen", a VS Code feature that executes the task automatically when the folder is opened in the editor.
Defenders are advised to alert on persistence artifacts including the \Maiden scheduled task.
It starts the real C:\Windows\System32\RuntimeBroker.exe suspended (CREATE_SUSPENDED | CREATE_NO_WINDOW).
The server proxies signaling so the existing JWT auth + per-client RBAC still apply... Overlord supports generic OIDC login... Local username/password login stays enabled as a fallback.
the malware leverages the password to extract browser credentials from Keychain and GNOME Keyring and subsequently relaunches itself as root to perform further Keychain and GNOME Keyring dumps.
Every time the user opens VS Code or Cursor on macOS or Linux, the VSIX extension activates, checks whether the subsequent infection portions are already running, and re-launches them if not.
It writes HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate_<4> pointing at ExplorerBroker.exe.
For Chrome, Edge, and Brave, elevated privileges are required to access credentials protected by App-Bound Encryption. COM Elevation Moniker is used to elevate privileges silently. If this fails, it falls back to Start-Process -Verb RunAs...
COM Elevation Moniker is used to elevate privileges silently. If this fails, it falls back to Start-Process -Verb RunAs, which displays the standard Windows UAC dialog.
The loader chain uses an EA06 encrypted a3x, cycled-XOR strings, RC4 key 8448433, and LZNT1; Arm B decrypts an embedded payload using the malfexteam2027 key.
Delivery Arm A downloads a Windows PE executable disguised as image/png from a public image host. Arm B retrieves a PNG polyglot containing an embedded payload.
It starts the real C:\Windows\System32\RuntimeBroker.exe suspended (CREATE_SUSPENDED | CREATE_NO_WINDOW).
The infection chain finishes by deleting malicious payloads and directories from the cloned repository in an effort to clean up forensic artifacts, while maintaining persistence through the VSIX extension.
It also schedules cleanup of vendor/ and .vscode/ via a background subshell that survives editor shutdown.
The server proxies signaling so the existing JWT auth + per-client RBAC still apply... Overlord supports generic OIDC login... Local username/password login stays enabled as a fallback.
When a developer clones the repository and opens it in Visual Studio Code or Cursor, a hidden file called tasks.json inside a concealed .vscode folder automatically runs malicious scripts.
The CMD file decodes an embedded script... The three encrypted payloads are decrypted at runtime using the hardcoded AES-256-GCM key...
Delivery Arm A extracts an IExpress cabinet containing a signed AutoIt3 interpreter and encrypted script.
The Linux backdoor uses Zenity... to create a prompt to collect user credentials. ... a second embedded Mach-O binary named darwin-password-prompt creates a fake system dialogue to prompt the user to enter their password.
On macOS, a secondary embedded binary called darwin-password-prompt presents a fake system dialog asking the user for their device password. ... On Linux, the malware uses a native system dialog tool called Zenity to create a similar fake prompt...
The Overlord RAT first extracts browser wallet extensions and standalone wallet directories and transmits them as a ZIP archive to the C2 server.
The Windows variant targets 35 cryptocurrency wallet extensions, 18 standalone wallet applications, and browser cookies. All collected data, including wallet contents, Safe Storage keys, login credentials, and browser cookies, is packaged into a ZIP file...
After the password is collected and validated, the malware modifies browser keychain access and dumps credentials from Chrome, Brave, Edge, Opera, and several other browsers. On Linux, ... targets GNOME Keyring credentials...
...dumps credentials from Chrome, Brave, Edge, Opera, and several other browsers. ... On Windows, it takes a more technical path that includes bypassing App-Bound Encryption in Chromium browsers and extracting credentials using DPAPI.
After password validation, the malware modifies Keychain ACLs for the following browsers... Safe Storage keys are then extracted. Following credential gathering, the backdoor re-launches itself as root... dump the entire login keychain.
The payloads communicate with a hardcoded C&C server, enabling remote command execution, system reconnaissance...
The payloads communicate with a hardcoded C&C server... followed by exfiltration of browser wallet extensions, decrypted credentials, and desktop wallets.
The Linux backdoor uses Zenity... to create a prompt to collect user credentials. ... a second embedded Mach-O binary named darwin-password-prompt creates a fake system dialogue to prompt the user to enter their password.
On macOS, a secondary embedded binary called darwin-password-prompt presents a fake system dialog asking the user for their device password. ... On Linux, the malware uses a native system dialog tool called Zenity to create a similar fake prompt...
All collected data, including wallet contents, Safe Storage keys, login credentials, and browser cookies, is packaged into a ZIP file and uploaded to the attacker-controlled server...
Operators talk to the server through a web panel or the Electron desktop app, and agents connect over encrypted WebSockets.
wss://devin-us.com/api/clients/70b1b74e862b/stream/ws?role=client
WebRTC P2P: browser ↔ agent direct when possible, with the bundled Coturn server as a fallback for restrictive or symmetric NAT... WebRTC Relayed: agent publishes to a MediaMTX sidecar via WHIP, browser plays via WHEP.
these binaries function as full RATs with persistent WebSocket connectivity.
The recovered Overlord build includes a live Solana blockchain C2 resolver; the Solana-memo C2 channel is wired into this build as live literal strings.
The loader fetches its second stage from GitHub releases, with TankRat file-share servers as a fallback.
The remote desktop viewer has a Transport dropdown with three modes: Canvas (default)... WebRTC P2P... WebRTC Relayed...
All collected data, including wallet contents, Safe Storage keys, login credentials, and browser cookies, is packaged into a ZIP file and uploaded to the attacker-controlled server at 23.137.105[.]75:5173.
297 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.