Reported by 4 outlets
macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor
Why this score
- Breadth
- 2.00 / 2.0 · 4 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.59 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
A macOS backdoor named CloudSyncD is being delivered through a fake Zoom installer. Jamf researchers first saw it in development in mid-September and within days observed samples moving to active deployment. The dropper mounts a disk image named Zoom and requires user activation; once triggered it writes a universal Mach-O payload (approximately 756 KB) to an anonymous file descriptor and attempts execution. System Integrity Protection blocks most executions, after which the dropper falls back to writing temporarily to disk and running with sudo along with a hidden administrator password stored in zero-width Unicode characters.
The malware is not tied to a specific CVE. The shift from testing to deployment suggests active social engineering campaigns rather than widespread automated exploitation. Watch for new samples, improved Gatekeeper bypass techniques, and expanded targets beyond macOS.
Timeline
-
original reporting
macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor
securityweek.com · 11d ago · October 2nd, 2026
A macOS dropper has been found inside a disguised Zoom client. The malware is tracked as CloudSyncD and is designed to deliver a persistent and stealthy backdoor. Researchers at Jamf first noticed this malware still in development in mid-September. Within days, other samples were found suggesting it has now progressed from testing and development to deployment. The malware infection process is initiated by any of the standard social engineering methods designed to persuade or trick victims into downloading dangerous content. In this case it is malware hidden in malicious code disguised as a Zoom Mac installer. If the phish is successful, a malware dropper is delivered to the victim as a disk image that mounts as a volume named Zoom. This dropper contains the payload but must be activated by the victim – hence the disguise as a Zoom installer. The victim is guided through the activation thinking it will install Zoom, but it actually installs CloudSyncD. The dropper “carries a complete universal Mach-O inside itself, roughly 756 KB in the development build, and extracts it at runtime. The same payload is also present on disk inside the application bundle, so the dropper has two sources for it,” say the researchers . The payload is written to an anonymous file descriptor, and the dropper attempts to execute it. Execution will fail in most cases because of the MacOS System Integrity Protection. If so, the dropper writes the file temporarily to disk and executes it using sudo alon
-
update from dailytechnow.com
Discover how the new CloudSyncD macOS malware disguises itself as a fake Zoom installer to bypass Gatekeeper and steal your administrator pa
dailytechnow.com · 10d ago · October 3rd, 2026
Discover how the new CloudSyncD macOS malware disguises itself as a fake Zoom installer to bypass Gatekeeper and steal your administrator pa
via Mastodon https://dailytechnow.com/cloudsyncd-macos-malware-zoom/
-
update from cyberworldops.eu
Jamf reports a fake Zoom installer delivering CloudSyncD, a persistent backdoor for macOS. Rapid shift from testing to deployment suggests a
cyberworldops.eu · 10d ago · October 4th, 2026
Rapid shift from testing to deployment suggests a
via Mastodon https://cyberworldops.eu/en/fake-zoom-installer-uses-cloudsyncd-to-establish-persistent-access-on