Fake Zoom Installer Tricks Mac Users Into Installing New CloudSyncD Backdoor

A fake Zoom installer is tricking Mac users into handing over their login passwords and launching CloudSyncD, a newly identified backdoor.

The malware hides inside an application that looks familiar, using installation instructions and counterfeit prompts to turn routine setup into a privileged infection.

The first sample appeared on September 15, 2026, while still under development. Within two days, researchers found related builds pointing to reachable command servers across two domains, suggesting a move toward deployment.

The report does not establish infection numbers, affected organizations, or confirmed downstream losses. Jamf Threat Labs researchers identified the malware during routine monitoring of executables uploaded to VirusTotal.

Jamf said in a report shared with Cyber Security News (CSN) that CloudSyncD uses two stages, with the backdoor already embedded inside the installer rather than fetched separately.

The immediate risk is unauthorized execution with elevated privileges and a channel for additional malicious programs.

Although the password lure resembles an information stealer, researchers found no built-in collection of browser records, keychain items, or cryptocurrency wallets, distinguishing it from recent MacSync malware campaigns that combine theft with remote access.

Fake Zoom Installer Tricks Mac Users

The disk image presents a familiar installation layout, pairing an application icon with an Applications shortcut. Its background adds step-by-step instructions directing users into System Settings, then Privacy & Security, where they are told to select Open Anyway and enter their administrator password.

These directions bypass Gatekeeper because the application lacks a trusted developer signature. The approach depends on persuasion rather than an operating-system exploit, echoing fake conferencing software updates that encourage people to override safeguards while believing they are completing a legitimate installation.

After launch, a counterfeit authorization dialog requests the user’s password. The installer checks the response against the local account and repeats the prompt until authentication succeeds. A fake download progress window helps maintain the appearance of a normal setup process.

The captured password is concealed inside an apparently ordinary settings file. Its base64-encoded value sits between random filler characters, while 48 invisible Unicode characters appended to the version field identify its position and length.

The report describes local storage, but no password transmission to attackers. The installer first tries to launch its embedded payload without leaving a conventional executable on disk.

That attempt failed during testing because of macOS protections. It then writes a temporary copy and uses the captured password to run the backdoor with elevated privileges.

Backdoor Awaits Additional Payloads

CloudSyncD supports both Apple silicon and Intel Macs. On first contact, it sends a device survey containing hardware details, operating-system information, account and machine names, and network information.

Later check-ins carry only the hardware identifier, with live-build traffic observed every eight to 16 seconds. The server can return encrypted tasks containing executable programs, either directly or inside compressed archives.

This differs from a conventional remote shell: researchers expect newly launched binaries rather than arbitrary shell commands, making process monitoring important when investigating suspected activity.

Its endpoints imitate requests for a JavaScript library, helping traffic resemble ordinary web activity. Both stages accept any presented server certificate. Shared encryption material across the analyzed builds also gives defenders a way to correlate samples and decode captured communications.

The encrypted log records can reveal the contacted server, device identifier, and check-in history. Researchers also noted that password validation exposes the supplied credential in process arguments, creating a useful detection opportunity.

Researchers did not observe persistence, a completed application replacement, or delivery of remote tasks. Unlike fake CAPTCHA backdoor infections that establish startup mechanisms, the tested samples remained at their staging locations.

Those limits matter: available evidence supports a working privileged backdoor, not every intended feature. Jamf recommends blocking and reporting similar threats through endpoint and web protections.

For investigation, its report highlights encrypted implant logs, invisible characters in settings files, temporary payload patterns, and password-validation command lines. The complete source indicators below preserve those hunting details without adding unpublished hashes.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Fake Zoom Installer Tricks Mac Users Into Installing New CloudSyncD Backdoor appeared first on Cyber Security News.