Fake Zoom installer for Mac spreads CloudSyncD backdoor

A new macOS backdoor named CloudSyncD has been discovered hidden in a fake Zoom installer, according to Jamf. The installer instructs users to bypass Apple's built-in security and prompts for their system password. This password is used to launch a malicious payload with elevated rights. The malware establishes encrypted contact with a remote server to execute commands or run files. No confirmed infections have been reported so far.

• Malware disguises as a Zoom installer disk image
• Instructs users to override macOS security warnings
• Harvests password for privilege escalation, not theft
• Backdoor can receive commands and execute remote code
• Jamf found no evidence of widespread infection