CloudSyncD Malware Disguised as Zoom Installer on macOS Tricks Users into Providing Passwords and Deploys a Backdoor

Researchers from Jamf Threat Labs disclosed the discovery of CloudSyncD malware on macOS, which mimics a Zoom installer. This malware uses instructions on the installation page to trick users into bypassing Gatekeeper protections before presenting a fake prompt for local account passwords. The malware validates user input against the local account, encodes the password using Base64 and stores it in a data.json file along with extra data and invisible Unicode characters. This process launches a second-stage backdoor with sudo privileges, embedding a payload within the installer. The backdoor gathers system information and communicates with command-and-control (C2) infrastructure to receive further executable files or archives. Testing did not reveal password transmission to the C2 server or direct capabilities for stealing data from browsers, Keychain, or cryptocurrency wallets. Users are advised to download software only from official sources and exercise caution with installers that request bypasses of security protections. The malware was observed not establishing persistence mechanisms like LaunchAgent or LaunchDaemon during testing.

The narrative centers on the exploitation of user trust in legitimate software installers to achieve high-privilege access and establish remote control. The mechanism bypasses standard security controls (Gatekeeper) by leveraging social engineering—the mimicry of a trusted application (Zoom). This transition from simple user input (password) to system-level execution (sudo backdoor) reveals a sequence where initial deception is leveraged to escalate privileges, suggesting that the weakest link in security is often human decision-making regarding installer prompts. The fact that the malware avoids observable persistence mechanisms like LaunchAgent or LaunchDaemon suggests an intent focused on immediate operational control rather than long-term, stealthy residency. This points toward an attack methodology optimized for rapid execution and data exfiltration (via C2 file reception) rather than traditional espionage setups. The lack of direct evidence of sensitive credential theft from specific system stores (Keychain, browsers) shifts the focus to the compromise of active system capabilities and network access. This raises the question: if persistence is intentionally avoided, what is the expected lifecycle and ultimate objective when the system is not immediately compromised for persistent remote access? What are the systemic vulnerabilities in trusting application provenance versus maintaining granular control over execution permissions?