Incident Report: Fake Video Meeting macOS Compromise and Telegram Takeover

1. Executive Summary

On 24 April 2026 (from 08:03 UTC), the user was invited to a video meeting over Telegram and directed to a counterfeit Microsoft Teams meeting page (the user recalled it as Zoom). Within roughly four minutes, the attacker harvested the macOS login password through a fake system password dialog and installed a root-level backdoor (cloudsync) with boot-time persistence.

The backdoor remained active for about 193 days. During that period it:

• pulled second-stage payloads and encrypted configuration on 2026-05-05 and 2026-06-03;
• on 2026-05-25, installed a spyware Chrome extension masquerading as “Google Docs Offline” into all four Chrome profiles, paired with an unsigned Native Messaging Host capable of running arbitrary shell commands;
• the extension exfiltrated all cookies every 30 s, logged keystrokes and clipboard, took screenshots every 6 s, and uploaded every site’s localStorage (including Telegram Web session tokens).

The most likely cause of the Telegram takeover is session hijacking (stolen cookies / localStorage tokens), which bypasses both password and 2FA.

On the day of investigation (2026-11-03) both malware sets were still running and connected to C2. Processes were terminated, persistence removed, samples quarantined, the C2 domain blocked, and three rounds of in-depth re-examination found no further known artefacts.

The tradecraft closely matches public reporting on the DPRK-nexus APT BlueNoroff (a Lazarus sub-group) “GhostCall” fake-meeting campaign. Evidence is insufficient for definitive attribution; this report states only that the techniques are consistent.

2. Timeline

timeline
    title Intrusion timeline (UTC)
    2026-04-24 08h03 : Fake password-popup component created
                     : ~/Library/Staging created
    2026-04-24 08h04 : User screenshot - fake Teams lobby
    2026-04-24 08h05 : Identification dir and auth.db created
    2026-04-24 08h06 : Root backdoor cloudsync written
    2026-04-24 08h07 : LaunchDaemon com.safari.sync.service created
                     : Encrypted config .com.apple.better.env
    2026-05-05 : Stage-2 encrypted data .apple.auth
    2026-05-25 03h40 : Spyware Chrome extension and Native Host planted
    2026-06-03 : Stage-2 binary .authds
    2026-06-23 : LaunchAgent com.apple.google.auth updated
    2026-11-03 : Detection, containment, eradication, re-examination

Note: some files inside the extension folder show a 2025-10-16 birth time. No malicious activity was found on that date, so these are judged to be timestamps preserved from the attacker’s package. The install time in Secure Preferences (2025-08-13) is likewise forged. The real deployment time, 2026-05-25, is taken from data.js, which contains the victim’s hostname.

3. Attack Flow (UML Sequence Diagram)

sequenceDiagram
    autonumber
    actor A as Attacker
    participant TG as Telegram
    actor U as Victim
    participant W as Fake Teams/Zoom page
    participant OS as macOS
    participant BD as cloudsync (root backdoor)
    participant CH as Chrome + spyware extension
    participant NH as Native Host<br/>google.chrome.diagnostics
    participant C2 as C2 server<br/>check02id.com (83.136.210.180)

    A->>TG: Meeting invitation posing as contact / business partner
    TG->>U: Meeting link
    U->>W: Opens link, lands on fake lobby
    W->>U: "Audio / SDK update required"
    U->>OS: Runs downloaded script / program
    OS->>U: Fake system password prompt (Mac-Password-Popup)
    U->>OS: Enters macOS login password
    Note over OS: Password captured → sudo escalation
    OS->>BD: Writes cloudsync + LaunchDaemon (root)
    loop every 60 s
        BD->>C2: Beacon (TCP 5202)
        C2-->>BD: Tasks / payloads
    end
    BD->>OS: Drops .authds, .apple.auth (May–Jun)
    BD->>CH: Plants fake "Google Docs Offline" extension (4 profiles)
    BD->>NH: Plants and registers Native Host
    loop continuous
        CH->>C2: All cookies every 30 s (TCP 5078)
        CH->>C2: Keylog / clipboard every 60 s
        CH->>C2: Screenshots every 6 s, localStorage, history (8443)
        C2-->>CH: Real-time tasks over WebSocket (wss 8443/realtime)
        CH->>NH: Relays remote shell commands
        NH-->>CH: Command output
    end
    A->>TG: Logs in with stolen session
    Note over A,TG: Account takeover (password and 2FA bypassed)

4. Malware Architecture (UML Component / Deployment View)

flowchart TB
    subgraph Host["Victim host (macOS)"]
        direction TB
        subgraph Persist["Persistence"]
            LD["/Library/LaunchDaemons/<br/>com.safari.sync.service.plist<br/>(root, RunAtLoad)"]
            LA["~/Library/LaunchAgents/<br/>com.apple.google.auth.plist<br/>→ ~/Library/Identification/.verify"]
        end
        subgraph Stage1["Stage 1 (root)"]
            CS["~/Library/CloudSync/cloudsync<br/>unsigned Mach-O x86_64 7.26MB"]
            ENV["/Users/Shared/.com.apple.better.env<br/>encrypted config"]
            PP["ammad.Mac-Password-Popup<br/>fake password dialog"]
            AUTH["Authorization/auth.db<br/>points to .verify"]
        end
        subgraph Stage2["Stage 2"]
            AD["/Users/Shared/.authds<br/>unsigned Mach-O 5.24MB"]
            AA["/Users/Shared/.apple.auth<br/>encrypted data"]
        end
        subgraph Browser["Chrome (4 profiles)"]
            EXT["Fake Google Doc Sheets Offline<br/>ppconlkbhfnachephglhgbhdgeapgjoj<br/>MV3, &lt;all_urls&gt;"]
            NMH["NativeMessagingHosts/<br/>google.chrome.diagnostics<br/>unsigned Mach-O 6.03MB"]
        end
    end
    C2[("C2: check02id.com<br/>83.136.210.180<br/>:5078 / :8443 / :5202")]

    LD -->|boot| CS
    LA -.->|target file missing| AUTH
    CS --> ENV
    CS -->|download| AD
    CS -->|download| AA
    CS -->|install| EXT
    CS -->|install| NMH
    EXT <-->|nativeMessaging| NMH
    CS <-->|TCP 5202 every 60 s| C2
    EXT <-->|HTTPS 5078 / WSS 8443| C2

5. Spyware Extension Capabilities (UML Class Diagram)

classDiagram
    class FakeDocsOfflineExtension {
        +id: ppconlkbhfnachephglhgbhdgeapgjoj
        +manifest_version: 3
        +location: 4 (not Web Store)
        +host_permissions: all_urls
        +permissions: cookies, history, tabs, scripting, desktopCapture, pageCapture, nativeMessaging
        +C2_http: check02id.com:5078/update
        +C2_ws: wss://check02id.com:8443/realtime
        +token: hard-coded shared secret
    }
    class ContentScript1 {
        +keydown() keylogger
        +copy()/paste() clipboard capture
        +click() triggers screenshots
        +visibilitychange() uploads localStorage
    }
    class ContentScript2 {
        +Hooks Google Meet Join-now button
        +Lures user into granting Screen Recording
    }
    class BackgroundWorker {
        +f3: upload all cookies every 30 s
        +keylog: upload every 60 s
        +capture: 36 screenshots, 6 s apart
        +cmd3: on-demand cookie dump
        +cmd4: wipe a site's cookies/storage (forces re-login)
        +cmd11: upload 10,000 history entries
        +cmd13: inject arbitrary JS into chosen URLs
        +cmd14/15/16: remote shell via Native Host
        +cmd17: MHTML page capture
    }
    class NativeHost_google_chrome_diagnostics {
        +unsigned x86_64
        +runs payload with cwd/timeout
    }
    FakeDocsOfflineExtension *-- ContentScript1
    FakeDocsOfflineExtension *-- ContentScript2
    FakeDocsOfflineExtension *-- BackgroundWorker
    BackgroundWorker --> NativeHost_google_chrome_diagnostics : sendNativeMessage

Impact note: cmd4 can wipe a site’s cookies to force the victim to log in again, and the keylogger then captures the freshly typed password. cmd13 can inject arbitrary script into exchange or wallet sites, for example to swap a recipient address.

6. Indicators of Compromise

6.1 Network

6.2 File hashes (SHA-256)

6.3 Host paths and identifiers

/Library/LaunchDaemons/com.safari.sync.service.plist
~/Library/LaunchAgents/com.apple.google.auth.plist
~/Library/CloudSync/cloudsync
~/Library/Identification/.verify
~/Library/Staging/
~/Library/Application Scripts/ammad.Mac-Password-Popup/
~/Library/Application Support/Authorization/auth.db
/Users/Shared/.authds
/Users/Shared/.apple.auth
/Users/Shared/.com.apple.better.env
~/Library/Application Support/Google/Chrome/NativeMessagingHosts/google.chrome.diagnostics
~/Library/Application Support/Google/Chrome/NativeMessagingHosts/com.google.chrome.diagnostics.json
Chrome extension ID: ppconlkbhfnachephglhgbhdgeapgjoj (name "Google Doc Sheets Offline", v1.97.1)
Hard-coded extension token prefix: jfweibd234HFIDhfiwef…
data.js fields: cuid, cprofile, cbrowser, cserverUrl, cuserName, chostName, cwsServerUrl (unique per victim)

7. MITRE ATT&CK Mapping

8. Response Actions (UML State Diagram)

stateDiagram-v2
    [*] --> Detection
    Detection --> Analysis: Suspicious LaunchDaemon/Agent found
    Analysis --> Containment1: cloudsync confirmed running as root
    Containment1 --> Eradication1: cleanup_malware.sh (user sudo)
    Eradication1 --> Review1: No residual processes / launch items
    Review1 --> Containment2: Unsigned Native Host + fake extension, live C2 session
    Containment2 --> Eradication2: Chrome closed, extension quarantined from 4 profiles
    Eradication2 --> Block: check02id.com sink-holed in /etc/hosts
    Block --> Review2: Root-level deep check (BTM/cron/sudoers/TCC)
    Review2 --> Review3: App signature integrity, injection, scripts, logs, IoC sweep
    Review3 --> Pending: Credential rotation, wallet migration, reinstall
    Pending --> [*]

9. Verification Scope and Results

Residual item (low risk): the extension’s registration entries remain in Secure Preferences of all four Chrome profiles. Its code has been removed, so it cannot run. Confirm at chrome://extensions and click Remove if it is listed.

10. Impact Assessment

11. Recommendations

Immediate (within 24 h, from a separate, clean device)

1. Google account: Security → “Sign out of all other devices”, change password, enable passkeys or a hardware security key.
2. Telegram: Settings → Devices → “Terminate all other sessions”; set a 2-Step Verification password; check the login email.
3. Crypto: create a wallet with a brand-new seed phrase on a clean device and move all funds; revoke token approvals on old addresses.
4. Banking, exchanges, email, cloud services: sign out all sessions → change password → review API keys and withdrawal whitelists.
5. Change the macOS login password and the Apple ID password.

Short term (within 1 week)

1. Back up documents only (not applications or ~/Library), erase the disk and reinstall macOS.
2. Do not restore Chrome extensions from the old profile; reinstall only from the Chrome Web Store.
3. Report to local law enforcement and the national CERT, providing this report and the quarantined samples.

Long term

1. Join meetings from chat invitations only through the official app; never install “SDKs”, plug-ins or “audio fixes”.
2. Treat any system password prompt you did not trigger yourself as hostile.
3. Keep crypto assets in a hardware wallet; never type a seed phrase into a computer.
4. Periodically review chrome://extensions for anything not from the Web Store.

12. Attribution Assessment

Conclusion: strong technique overlap, medium confidence. No reverse engineering of the samples or threat-intelligence platform correlation was performed; this is not a formal attribution.

Appendix A: Sample Availability

Samples are held in an encrypted archive. Security researchers and law enforcement may request them privately from the publisher of this report.

⚠️ The samples are live malware. Do not extract or run them outside an isolated analysis environment.