Security researchers at Jamf Threat Labs have discovered a stealthy new malware campaign targeting Apple Mac users. The threat involves a malicious disk image designed to look like a legitimate Zoom installer that delivers a newly identified backdoor dubbed CloudSyncD.

By leveraging social engineering, the malware tricks users into manually overriding operating system security controls before harvesting their system credentials to execute an embedded second-stage backdoor payload.

New CloudSyncD Backdoor Threatens macOS Users

The campaign centers on the deployment of a two-stage macOS Trojan tracked as CloudSyncD. Discovered during routine scanning on VirusTotal, early builds of the threat were identified in mid-September, with fully active command-and-control infrastructure coming online shortly thereafter. Unlike traditional infostealers that harvest browser session cookies, saved keychain items, or cryptocurrency wallets, CloudSyncD focuses primarily on establishing persistent, high-privilege access to the target host.

Once activated, the malware executes an initial host survey to gather hardware configuration data, system architecture, active user details, and operating system build information. This information is transmitted over encrypted channels to attacker-controlled infrastructure, enabling the threat actors to issue remote execution commands and launch custom Mach-O binaries.

How the Fake Zoom Installer Tricks Victims

The infection chain begins when a victim downloads a malicious disk image (.dmg) disguised as an installer for the popular Zoom video conferencing application. Upon opening the image, the user is presented with a standard macOS drag-and-drop installer window featuring a custom background image.

Because the app bundle is only ad-hoc signed, macOS automatically blocks execution via its Gatekeeper security system. To circumvent this safeguard, the installer background contains explicit step-by-step instructions directing the user to navigate to System Settings, access the Privacy & Security section, and select the option to open the unsigned application anyway. This social engineering strategy relies on user compliance rather than technical zero-day exploits to bypass Apple's defense mechanisms.

Key Capabilities and Password Theft Mechanism

Once launched, the first-stage binary, operating under the name app_installer, presents a fake system authorization dialog requesting the user's account password. To ensure accuracy, the script validates the entered credential locally against the account using the native macOS directory service command-line utility dscl. The prompt repeatedly reappears until the user enters the correct administrator password.

After successful validation, a fake progress window titled "Downloading Zoom..." appears to maintain the illusion of a routine application installation. In the background, the dropper writes the user's password into a decoy JSON configuration file located within the user's home directory structure.

Gatekeeper Overrides and Base64 Obfuscation

To obscure the stolen credential from static detection mechanisms, the malware applies Base64 encoding and pads the string with random filler text before writing it into ~/.config/zoom/data.json. Furthermore, the developers utilized zero-width Unicode characters inside an adjacent software version field to encode the exact starting index and length of the hidden password string.

With administrative access secured, the first stage elevates its execution context using sudo to launch the second-stage payload. The embedded payload is constructed as a universal Mach-O binary, enabling native execution on both Intel and Apple silicon Mac models. While the dropper attempts to execute the second stage in-memory using file descriptors to avoid writing to disk, fallback routines write the binary to a temporary file when memory execution fails.

This incident reflects a broader trend of targeted threats aimed at Mac systems. Malicious campaigns increasingly abuse trusted platforms and brand names to evade automated network filters. For instance, researchers previously highlighted campaigns where the MacSync Malware Uses iCloud Calendar Invites to distribute malicious payloads directly to unsuspecting users.

Protecting macOS Systems From CloudSyncD Attacks

Apple continues to update its native XProtect signatures and internal security controls to neutralize emerging malware families. In parallel, Apple has recently introduced broader administrative protections; for example, Apple Tightens macOS Full Disk Access Controls Over AI Privacy Risks to limit unauthorized file system access by unverified background processes.

To guard against threats like CloudSyncD, enterprise system administrators and individual users should adhere to established security best practices:

  • Only download software applications directly from official developer websites or the Mac App Store.
  • Exercise extreme caution whenever an installation window explicitly asks you to manual override Gatekeeper protections in System Settings.
  • Verify the source of authorization prompts before entering your administrator password.
  • Deploy endpoint detection and response (EDR) solutions capable of monitoring process spawns involving utilities like dscl and sudo.

Verification and Remediation Steps

Organizations suspecting a potential CloudSyncD compromise should inspect Mac endpoints for suspicious processes running under the daemon name cloudsyncd. System administrators should audit localized configuration paths, specifically checking for hidden files located inside ~/.config/zoom/ and ~/.local/share/cloudsync/.

If an infection is identified, affected machines should be immediately isolated from local network segments to interrupt active command-and-control communication channels. Additionally, account passwords for any users who interacted with the fake authorization prompt must be reset immediately to prevent credential abuse.

As cybercriminals continue to refine multi-stage macOS droppers and obfuscation methods, remaining vigilant against social engineering tactics remains the most effective line of defense for Mac environments.