Fake Zoom installer hides macOS backdoor CloudSyncD
Jamf analyzes CloudSyncD, a fake macOS Zoom installer that steals passwords and deploys a backdoor.
Jamf Threat Labs analyzed CloudSyncD, first seen on VirusTotal on September 15 inside a disk image posing as a macOS Zoom installer. The ad-hoc-signed app walks users through a Gatekeeper bypass, repeatedly prompts for the account password, and validates it with dscl before hiding a padded base64 copy in data.json using 48 zero-width Unicode characters. The dropper embeds a universal Mach-O of about 756 KB, tries anonymous /dev/fd execution, and on SIP failure writes a temp file and launches it with sudo. The second stage, cloudsyncd, does not persist; it beacons every 8 to 16 seconds with a hardware identifier and can receive a compressed archive or executable from two live domains.
- Fake Zoom disk image coaches victims to bypass macOS Gatekeeper.
- A dialog steals the password, validates it with dscl, and hides it with zero-width Unicode.
- In-memory /dev/fd execution fails under SIP, so the payload runs via sudo.
- The cloudsyncd implant has no persistence and beacons every 8 to 16 seconds.
- C2 can deliver archives or executables; two live Cloudflare domains were observed.
- ATT&CK
- T1204.002 Malicious FileT1036 MasqueradingT1553.001 Gatekeeper BypassT1056.002 GUI Input CaptureT1548.003 Sudo and Sudo Caching
- Malware
- CloudSyncD
- Organizations
- Jamf
From the original article
4 min read at securityaffairs.com
Jamf Threat Labs details CloudSyncD, a fake macOS Zoom installer that hides a phished password using invisible zero-width Unicode characters. Jamf Threat Labs found CloudSyncD while doing routine scanning on VirusTotal, buried inside a disguised Zoom client. They first spotted it on September 15, clearly still under construction, and within two days watched it move […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.