CloudSyncD Malware Disguised as Zoom Installer on macOS Tricks Users into Providing Passwords and Deploys a Backdoor

546/69 Monday, October 5, 2026 Researchers from Jamf Threat Labs have disclosed the discovery of CloudSyncD malware on macOS, which disguises itself as a Zoom installer and uses instructions on the installation page to trick users into bypassing Gatekeeper protections before displaying a fake prompt requesting the password for the local account. Researchers first identified a sample on September 15, 2026, while it was still under development. Two days later, they discovered another sample connected to operational command-and-control (C2) infrastructure. However, there is currently no confirmed information regarding the number of affected users. When a user enters a password, the malware validates it against the local account before encoding the password in Base64 and storing it in a data.json file, along with additional data and invisible Unicode characters. The password is then used to launch a second-stage backdoor with sudo privileges, with the payload embedded within the installer. Once executed, the backdoor collects basic system information and connects to the C2 infrastructure to receive additional executable files or archives for execution on the system. During testing, researchers did not observe the user’s password being transmitted to the C2 server and found no direct capabilities for stealing data from browsers, Keychain, or cryptocurrency wallets. macOS users should download Zoom and other software only from official websites or authorized distribution channels. They should be cautious of installers that instruct them to select Open Anyway or otherwise bypass Gatekeeper protections, particularly when an installer requests a password and its source cannot be verified. Users who have executed an installer with similar behavior should inspect their systems for suspicious files, processes, and network connections. In the samples analyzed by Jamf, CloudSyncD was not observed creating persistence mechanisms that would automatically relaunch the malware after a system restart, such as a LaunchAgent or LaunchDaemon. Source: https://securityaffairs.com/200293/malware/fake-zoom-installer-hides-macos-backdoor-cloudsyncd.html