CloudSyncD macOS Backdoor Uses Fake Zoom Installer to Steal Passwords and Launch an Implant
Summary
Jamf Threat Labs analyzes CloudSyncD, a two-stage macOS backdoor delivered in a fake Zoom installer. It validates a phished password locally, hides it in a configuration file, and launches an embedded implant that beacons to operator infrastructure.
Key points
- The dropper is distributed as a disk image disguised as a Zoom installer and guides users to bypass Gatekeeper.
- A fake authorization prompt collects the login password; the dropper validates it locally with dscl and conceals it in data.json using base64 and zero-width Unicode.
- The embedded second-stage implant is launched first through /dev/fd; when that fails, the dropper writes it temporarily to disk and runs it using sudo and the collected password.
- The implant sends a host survey and checks in with its command-and-control server every 8 to 16 seconds; tasking can deliver executables or gzipped tar archives.
- Jamf reports seeing builds configured for reachable infrastructure within two days of finding a development build. The builds share code and cryptographic configuration while using different endpoints.
- In sandbox testing, researchers observed no persistence being established, and the planned application-bundle swap did not run.
Article Details
- Attack Vectors
- A disk image presented as a Zoom installer prompts victims to override Gatekeeper and launch an ad-hoc-signed app.
- The dropper presents a fake authorization dialog, validates the entered password against the local account with dscl, and uses the password to launch the second stage through sudo.
- The dropper carries the second-stage Mach-O inside itself. It attempts execution through /dev/fd, then falls back to writing a temporary file and executing it.
- The implant beacons to configured command-and-control endpoints and can receive base64-encoded, encrypted tasks that deliver a gzipped tar archive or a Mach-O executable.
- Defensive Notes
- Jamf recommends configuring Jamf for Mac threat prevention, advanced threat controls, and web protection to Block and Report.
- The article describes the installer artwork as guiding victims to override Gatekeeper; avoid following such instructions for an untrusted installer.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe dropper assembles a shell script from obfuscated fragments, and the implant's configuration is encrypted in its binary.T1056.002 · GUI Input CaptureAn AuthDialog fake authorization prompt captures the entered password.T1059.004 · Unix ShellThe dropper executes a generated shell script with /bin/bash; the implant also shells out to sh for directory creation and ioreg.T1082 · System Information DiscoveryThe implant gathers hardware and operating-system details using sysctl and ioreg for its initial host survey.T1105 · Ingress Tool TransferThe implant accepts task data from its C2 that can contain a gzipped tar archive or a Mach-O executable.T1140 · Deobfuscate/Decode Files or InformationThe implant base64-decodes and decrypts task data before dispatching it.T1204.002 · Malicious FileThe victim is instructed to open the disguised Zoom.app installer from a mounted disk image.T1548.003 · Sudo and Sudo CachingThe dropper uses the collected password with sudo to launch the second-stage implant.T1553.001 · Gatekeeper BypassThe ad-hoc-signed app is blocked by Gatekeeper on double-click, and the installer artwork guides the user to override that protection.
People
Malware
Products
Jamf for MacIn Jamf for Mac, customers can configure threat prevention, advanced threat controls and web protection to Block and Report to help prevent the execution of similar threats.macOSWhile performing routine monitoring of executables in VirusTotal, Jamf Threat Labs identified a macOS dropper buried within a disguised Zoom client. We are tracking this malware under the name CloudSyncD, after theZoomof executables in VirusTotal, Jamf Threat Labs identified a macOS dropper buried within a disguised Zoom client. We are tracking this malware under the name CloudSyncD, after the daemon name its second stage