Fake Zoom Installer Used to Distribute CloudSyncD Backdoor
Security researchers at Jamf have identified a macOS dropper concealed within a fraudulent Zoom installer that delivers the CloudSyncD backdoor. The malware was first observed in development during mid-September, and within days, additional samples emerged indicating a transition from testing to active deployment.
The infection chain relies on social engineering tactics to trick users into downloading what appears to be a legitimate Zoom application for macOS. When executed, the malicious disk image mounts as a volume named "Zoom" and presents itself as an installer. Users are guided through what they believe is a standard installation process, but instead triggers the deployment of CloudSyncD.
Technical Execution and Privilege Escalation
The dropper contains a universal Mach-O binary approximately 756 KB in size, which it extracts at runtime. A copy of the same payload is also stored within the application bundle on disk, providing dual sources for execution. The payload is initially written to an anonymous file descriptor, but execution typically fails due to macOS System Integrity Protection (SIP).
When SIP blocks direct execution, the dropper writes the payload temporarily to disk and attempts to execute it using sudo, leveraging the user’s password collected during the fake installation process. This method allows the malware to bypass security restrictions by obtaining elevated privileges through user interaction.
CloudSyncD Backdoor Functionality and Infrastructure
Once activated, CloudSyncD establishes persistence by running as a daemon under its namesake. The malware’s configuration is encrypted within the binary and decrypted at runtime. Analysis of early builds revealed a command-and-control (C2) server hosted on a private network with verbose debug logging enabled, indicating an early development stage.
More recent samples show the malware has evolved, with multiple builds hosted on two separate domains. Both domains use identical URI paths that mimic a jQuery script to disguise beacon traffic as ordinary JavaScript fetch requests. Registered in 2011 through the same registrar and protected by Cloudflare, these domains showed no security detections at the time of analysis.
Researchers noted that all builds share critical characteristics: the same string obfuscation table, installation paths, daemon name, process disguise, and crucially, the identical C2 key and initialization vector — down to the per-string seeds used in encryption. Only the C2 endpoint varies between builds, meaning that decryption keys extracted from any sample can be used to decode beacon traffic from all variants.
Behavior and Objectives of CloudSyncD
CloudSyncD functions as a persistent backdoor designed for long-term, stealthy access to compromised macOS systems. It performs host reconnaissance, collects system and user information, and exfiltrates this data to its C2 server. Despite early similarities to infostealers in delivery method, CloudSyncD does not steal credentials or exfiltrate passwords.
The user password gathered during installation is used exclusively locally to elevate privileges via sudo and is not transmitted to attackers. This distinguishes it from traditional infostealers, as its primary goal is to maintain a foothold for deploying additional payloads rather than immediate data theft.
Indicators of Compromise and Broader Implications
With CloudSyncD now confirmed in active deployment, Jamf has released a comprehensive list of indicators of compromise (IOCs) for detection and mitigation. The malware exemplifies a growing trend in macOS threats toward native implementations, advanced string obfuscation, and memory-based execution techniques aimed at reducing disk artifacts.
Nevertheless, it continues to rely on one of the oldest and most effective attack vectors: social engineering that manipulates users into voluntarily surrendering their credentials. As macOS malware matures in technical sophistication, its success still hinges on exploiting human trust through familiar lures like fake software updates or popular applications.
Source: SecurityWeek