CloudSyncD (Malware): news timeline & CVEs

Fake Zoom Installer Tricks Mac Users Into Installing New CloudSyncD Backdoor

A fake Zoom installer tricks Mac users into launching CloudSyncD, a new privileged backdoor.

Jamf Threat Labs identified CloudSyncD, a new macOS backdoor hidden inside a fake Zoom installer disk image. The first sample appeared on VirusTotal on September 15, 2026, and related builds pointed to reachable command servers within two days. The unsigned dropper instructs users to bypass Gatekeeper, captures the local password in a disguised settings file, and launches an embedded universal implant with elevated privileges. Researchers observed device surveys and check-ins every 8 to 16 seconds, but not persistence or completed remote-task delivery, and no victim count was reported.

Cyber Security News15:07 UTC · 6h agoMalware 3 sources

CloudSyncD MacOS Backdoor Hides Behind Fake Zoom Installer

Jamf found CloudSyncD, a macOS backdoor in a fake Zoom installer that captures a password to launch its payload.

Jamf Threat Labs reported CloudSyncD, a macOS backdoor delivered in a disk image that imitates a Zoom installer and instructs users to override Gatekeeper. A fake authorization dialog validates the local password, stores it using zero-width Unicode, and uses it to run an embedded universal Mach-O payload, attempting fileless execution through /dev/fd. Samples found after a September 15 development build pointed at live command-and-control servers and sent a host survey over encrypted traffic. Jamf did not confirm infections and said the implant lacked browser, Keychain, and wallet-theft features and showed no persistence during analysis.

Infosecurity Magazineupdated 15:07 UTC · 6h agofirst 13:30 UTC · 8h agoMalware 3 sources

CloudSyncD Uses Invisible Unicode to Hide Phished Mac Passwords in Plain Sight

CloudSyncD, a fake Zoom macOS backdoor, hides phished passwords with invisible Unicode and calls live C2.

Jamf researchers describe CloudSyncD, a macOS backdoor shipped as an ad-hoc-signed fake Zoom disk image that instructs victims to bypass Gatekeeper and enter an administrator password. The dropper validates the password with dscl and hides a base64 copy in ~/.config/zoom/data.json, using zero-width Unicode characters to mark its offset and length. That password launches a cloudsyncd second stage with sudo; the implant profiles the Mac and beacons over HTTPS to orchid-led.com and bjzhishang.com paths impersonating jquery.js. Live command-and-control samples appeared within two days of the September 15 discovery and can receive encrypted Mach-O or gzipped tar tasks.

GBHackersupdated 15:07 UTC · 6h agofirst 11:06 UTC · 10h agoMalware in the wild 3 sources

CloudSyncD

Timeline3 articles

Appears with

Fake Zoom Installer Tricks Mac Users Into Installing New CloudSyncD Backdoor

CloudSyncD MacOS Backdoor Hides Behind Fake Zoom Installer

CloudSyncD Uses Invisible Unicode to Hide Phished Mac Passwords in Plain Sight