[CLSTR]
< Back to all clusters
[TECHNOLOGY] · 7 sources

started · updated

CloudSyncD malware targets macOS via fake Zoom installer

CloudSyncD macOS malware Zoom fake installer Jamf Threat Labs backdoor

Jamf Threat Labs has identified a new macOS backdoor named CloudSyncD, which is distributed via a fraudulent Zoom application installer. The malware is designed to target both Intel and Apple Silicon Macs.

The attack begins when a user downloads a disk image disguised as a legitimate Zoom installer. The image contains instructions prompting the user to bypass macOS Gatekeeper security settings by manually selecting ‘Open Anyway’ in System Settings. Once the user provides their administrator password through a fake authorization prompt, the malware gains elevated privileges.

Unlike typical infostealers, CloudSyncD does not focus on harvesting browser data, cryptocurrency wallets, or keychain items. Instead, it functions as a backdoor. The second stage of the malware is embedded directly within the initial dropper rather than being downloaded from an external source. To avoid detection, the malware conceals the captured credentials within a decoy configuration file.

Entities

Apple · CloudSyncD · Jamf Threat Labs · Zoom · macOS

Claims

What the coverage asserts, and how many sources carry each claim.

  • [● 2 SOURCES] The malware instructs users to bypass macOS Gatekeeper via System Settings. www.mactech.com · www.jamf.com
  • [○ 1 SOURCE] The malware works on both Apple Silicon and Intel-based Macs. iphoneaddict.fr
  • [● 3 SOURCES] The malware uses a fake authorization prompt to phish the user's administrator password. iphoneaddict.fr · www.mactech.com · www.jamf.com
  • [○ 1 SOURCE] CloudSyncD was first encountered on September 15, 2026. www.jamf.com
  • [○ 1 SOURCE] CloudSyncD does not contain built-in features to collect browser data, keychain items, or cryptocurrency wallets. www.mactech.com
  • [● 2 SOURCES] The malware uses a decoy configuration file to hide the stolen password. www.mactech.com · www.jamf.com
  • [● 3 SOURCES] Jamf Threat Labs identified CloudSyncD, a macOS backdoor disguised as a fake Zoom installer. iphoneaddict.fr · www.mactech.com · www.jamf.com
  • [○ 1 SOURCE] The second stage of the malware is carried within the first stage rather than being downloaded separately. www.jamf.com

Sources

Il malware che non sa bucare macOS e chiede una mano all’utente [spider-mac.com]
Zoom : un nouveau malware demande à l’utilisateur de contourner lui-même Gatekeeper pour s’installer [www.macg.co]
CloudSyncD, un malware sur Mac qui se fait passer pour un installateur Zoom [iphoneaddict.fr]
Jamf Threat Labs identifies CloudSyncD, new malware that attacks macOS [www.mactech.com]
Fake Zoom installer tricks Mac users into bypassing Gatekeeper [www.cultofmac.com]
CloudSyncD: macOS backdoor hidden in a fake Zoom installer [www.jamf.com]
This fake Mac Zoom installer has a sneaky way to bypass Gatekeeper [9to5mac.com]