Fake Zoom Installer Delivers CloudSyncD Backdoor to macOS Users
Summary
Researchers report CloudSyncD, a persistent macOS backdoor delivered through a fake Zoom installer. It profiles infected Macs and exfiltrates system and user details; deployment-stage builds have been observed.
Key points
- Victims are tricked into activating a disk image disguised as a Zoom installer, which installs CloudSyncD.
- The dropper extracts and executes a Mach-O payload; if macOS System Integrity Protection blocks execution, it uses sudo with the password collected during activation.
- CloudSyncD runs as a daemon and is designed for stealthy, persistent access and delivery of follow-up payloads.
- The backdoor profiles hosts and exfiltrates system and user details to command-and-control servers; researchers say it does not function as a conventional infostealer.
- Researchers found builds on two domains and report shared obfuscation, installation paths, process disguise, and C2 key material across builds.
- Researchers say the malware has progressed from development to deployment and provide indicators of compromise for monitoring.
Article Details
- Attack Vectors
- Social engineering and phishing persuade victims to download a malicious disk image disguised as a Zoom Mac installer.
- The victim activates the disguised installer, which installs CloudSyncD and uses the password entered during activation locally to attempt execution with sudo.
- Defensive Notes
- The researchers recommend monitoring the on-host indicators they report; the supplied article does not include the IOC list or specific indicator values.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationCloudSyncD uses string obfuscation, and its encrypted configuration is decrypted at runtime.T1041 · Exfiltration Over C2 ChannelCloudSyncD exfiltrates system and user details to its C2.T1204.002 · Malicious FileThe victim must activate the disguised installer, causing the CloudSyncD payload to be installed.T1548.003 · Sudo and Sudo CachingIf normal execution fails because of System Integrity Protection, the dropper uses sudo with the password collected during activation to execute the payload.T1566 · PhishingVictims are socially engineered into downloading a malicious disk image disguised as a Zoom Mac installer.