Summary
- CloudSyncD is distributed through a fake Zoom installer targeting macOS users.
- The installation flow captures and locally validates the victim’s login password.
- Jamf saw later samples communicating with live infrastructure but did not observe persistence being established.
A fake Zoom installer targeting macOS users captures the victim’s login password before launching a second stage backdoor, according to research from Jamf Threat Labs.
Jamf is tracking the malware as CloudSyncD after the daemon name used by its second stage, having first encountered an apparent development build on 15 September before finding later samples configured to communicate with more than one live command and control domain.
Rather than bypassing every macOS security control automatically, the delivery chain depends on persuading the user to run software presented as Zoom and manually override the operating system’s refusal to launch the application normally.
Once opened, the installer asks for the Mac user’s password and validates the credential against the local account before continuing. The captured password is then concealed within a decoy configuration file using zero width Unicode characters.
The second stage connects to attacker infrastructure
After the initial installer completes its work, CloudSyncD launches another component that surveys the host and communicates with attacker controlled infrastructure, allowing executable tasking to be delivered to the compromised machine.
Jamf’s analysis shows the malware gathering information including hardware identifiers, processor details, memory, operating system data, user information, and device characteristics before checking back with its command and control server.
Despite the CloudSyncD daemon name and the presence of configured installation paths, Jamf explicitly says it did not observe the malware establishing persistence during testing. No LaunchAgent or LaunchDaemon was created, and the researchers did not see a binary placed at the configured persistent location.
That finding narrows the behaviour compared with the earlier description of a persistent backdoor, while leaving the core compromise intact: a victim who follows the fake installation process can surrender a valid local password and execute malware capable of receiving further binaries from attacker infrastructure.
The password itself may support actions requiring additional authorisation on the Mac, although Jamf did not establish that the captured credential was reused against external accounts or services.
Using Zoom branding also gives the delivery mechanism a familiar workplace context, since employees routinely install conferencing software and may be more willing to override a warning when the application appears to come from a recognised product.
Jamf has not published a confirmed victim count or attributed CloudSyncD to a named threat group, so the available evidence establishes the malware chain and live infrastructure without showing how widely it has been deployed.
