CTI · reviewed · 2026-10-04

macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor

Full story & timeline

MITRE ATT&CK

• T1036 Masquerading Stealth
• T1204 User Execution Execution
• T1548 Abuse Elevation Control Mechanism Privilege Escalation

Indicators

No curated indicators tied to this case.

Detections

No detection content yet — case analysis did not yield signal-specific telemetry. Check back after the next daily CTI pass.

References

• https://intel.threadlinqs.com/threat/TL-2026-2840
• https://dailytechnow.com/cloudsyncd-macos-malware-zoom/
• https://cyberworldops.eu/en/fake-zoom-installer-uses-cloudsyncd-to-establish-persistent-access-on