CloudSyncD MacOS Backdoor Hides Behind Fake Zoom Installer
Jamf found CloudSyncD, a macOS backdoor in a fake Zoom installer that captures a password to launch its payload.
Jamf Threat Labs reported CloudSyncD, a macOS backdoor delivered in a disk image that imitates a Zoom installer and instructs users to override Gatekeeper. A fake authorization dialog validates the local password, stores it using zero-width Unicode, and uses it to run an embedded universal Mach-O payload, attempting fileless execution through /dev/fd. Samples found after a September 15 development build pointed at live command-and-control servers and sent a host survey over encrypted traffic. Jamf did not confirm infections and said the implant lacked browser, Keychain, and wallet-theft features and showed no persistence during analysis.
- CloudSyncD poses as a Zoom disk image and tells users to bypass Gatekeeper.
- A fake prompt validates the local password and hides it with zero-width Unicode.
- That password launches a universal Mach-O payload, preferably through /dev/fd.
- Live C2 samples followed a development build first seen on September 15.
- Jamf reported no confirmed infections and no browser, Keychain, or wallet theft.
Full article415 words · extracted from infosecurity-magazine.com · click to collapse
A new macOS backdoor has been hidden inside a fake Zoom installer that prompts users for their login password before launching an embedded second stage.
The malware, dubbed CloudSyncD, has moved from development testing to samples configured against live command-and-control (C2) infrastructure.
Jamf Threat Labs first encountered CloudSyncD on September 15 in a build that was still under development, according to research published September 30. Two days later, it found samples configured against live C2 infrastructure across more than one domain, indicating the operation had progressed toward deployment.
The malware arrives as a disk image designed to resemble a legitimate Zoom installer. Its instructions tell users to override macOS security protections through the System Settings interface, guiding them around Gatekeeper.
The installer then presents a fake authorization prompt and validates the supplied password against the local account.
Jamf said the password is never sent anywhere. Instead, CloudSyncD buries it in a decoy configuration file, using zero-width Unicode characters to mark where it sits.
Two-Stage macOS Malware Delivery
The password is then used to launch the second stage with elevated privileges. Jamf said the embedded payload is a universal Mach-O binary supporting both Apple silicon and Intel Macs.
The backdoor attempts to execute the payload through /dev/fd to avoid writing the binary to disk. When that approach failed during Jamf's testing, the malware wrote the payload temporarily and launched it using sudo with the harvested password.
CloudSyncD establishes a hidden working directory under the user's home folder and is configured to operate under the name cloudsyncd. Its C2 communication uses encrypted traffic and sends an initial host survey containing system information before subsequent check-ins carry the machine's hardware identifier.
A Backdoor Rather Than an Infostealer
Despite its password prompt, CloudSyncD does not appear to be a conventional credential stealer. Jamf said the malware did not contain built-in functionality for collecting browser data, Keychain items or cryptocurrency wallets, and the captured password was used to facilitate execution of the second stage.
The implant's remote task execution capability allows its operator to deliver executable files or compressed archives for execution. Jamf did not observe persistence. It also never saw the implant install itself as cloudsyncd, a step it said was not reached because no task was delivered during its analysis.
Jamf found CloudSyncD through VirusTotal monitoring and did not report any confirmed infections.
Image credit: DANIEL CONSTANTE / Shutterstock.com