Security firm Jamf Threat Labs has identified a new Mac malware family named CloudSyncD, disguised as a Zoom installer. Rather than exploiting zero-day vulnerabilities in macOS, the malware relies on social engineering to coax users into manually disabling system defenses like Gatekeeper and handing over administrator privileges.
How CloudSyncD Bypasses Gatekeeper
CloudSyncD is distributed as a disk image mounting under the name Zoom, complete with visual elements designed to mimic legitimate software installation windows. The installer background displays explicit instructions directing users to open System Settings, navigate to Privacy & Security, and select Open Anyway to bypass macOS notarization checks.
Once executed, the installer presents a fake authorization prompt requiring an admin password. The malware validates the password against the local Mac account, repeatedly prompting until the user enters it correctly. To avoid immediate detection, the installer hides the validated credentials within a decoy Zoom configuration file marked with invisible Unicode characters instead of transmitting the password over the network.
Backdoor Functionality and Campaign Progress
Using the harvested administrator privileges, CloudSyncD executes a hidden backdoor compatible with both Apple Silicon and Intel Macs. The payload collects system metrics—including hardware ID, CPU type, installed RAM, macOS version, and username—and transmits them to a command-and-control server. The backdoor polls this server every 8 to 16 seconds to retrieve and execute additional binaries or compressed archives.
Jamf Threat Labs first detected a CloudSyncD sample on September 15, 2026. While early variants lacked targeted information-stealing routines such as browser data or Keychain harvesting, subsequent samples showed active communication with live infrastructure. Jamf noted that the malware has not yet been linked to a specific threat actor. Users can avoid compromise by downloading software exclusively through official channels such as zoom.us or the Mac App Store, and refusing system prompts to override Gatekeeper.
AI-generated editorial illustration; not a documentary photograph.
Source: Fake Zoom installer tricks Mac users into bypassing Gatekeeper
SIGNAL TITANS
Leave a Reply