CloudSyncD Uses Fake Software Setup to Establish Privileged macOS Control
Security researchers have uncovered CloudSyncD, a newly identified macOS backdoor distributed through a malicious application masquerading as the Zoom client.
Jamf Threat Labs first detected the malware on September 15, 2026, while it was still under development.
Within two days, researchers found additional builds communicating with live command-and-control infrastructure, indicating that its operators were moving toward deployment.
The campaign combines social engineering, password harvesting and attempted fileless execution to establish privileged access on both Apple silicon and Intel Macs.
Fake Installation Turns Gatekeeper Into a Social-Engineering Target
CloudSyncD arrives inside a disk image designed to resemble an ordinary Zoom installer.
Victims Are Told to Override macOS Protection
Because the malicious application is only ad-hoc signed, Gatekeeper normally prevents it from launching.
Instead of technically defeating Gatekeeper, the installer provides step-by-step instructions telling users to open Privacy & Security and manually select Open Anyway.
This distinction is important: the malware does not exploit a Gatekeeper vulnerability—it convinces the victim to bypass the protection.
Fake Authorization Prompt Captures the Password
After execution, the installer presents what appears to be a legitimate macOS authorization request.
Password Is Verified Before the Attack Continues
The supplied credential is checked locally using dscl. Incorrect passwords cause the prompt to reappear until a valid credential is entered.
CloudSyncD then conceals the captured password inside:
~/.config/zoom/data.json
The credential is Base64-encoded and hidden among randomly generated filler.
Invisible Unicode Characters Conceal Its Location
The malware uses 48 zero-width Unicode characters appended to a seemingly normal version field to encode the offset and length needed to recover the password.
Because these characters are invisible in ordinary text, the configuration file can appear relatively benign during casual inspection.
Embedded Payload Attempts Fileless Execution
CloudSyncD does not need to download its main implant after the initial compromise.
Universal Mach-O Supports Intel and Apple Silicon
The dropper contains a complete universal Mach-O payload capable of executing on both processor architectures.
It first attempts to launch the implant through an anonymous file descriptor under /dev/fd, reducing the need to place the executable conventionally on disk.
Jamf found that this technique failed during testing—an outcome expected on most Macs because of System Integrity Protection (SIP).
The malware then falls back to writing the payload into a temporary file and executes it through sudo, using the password previously obtained from the victim.
CloudSyncD Opens the Door to Additional Malware
Once active, the implant profiles the infected Mac and communicates with its C2 infrastructure every 8 to 16 seconds.
Operators Can Deliver Complete Executables
Rather than functioning primarily as a remote shell, CloudSyncD accepts tasking capable of delivering compressed archives or complete Mach-O executables.
This gives its operators a flexible mechanism for deploying additional malware after gaining access.
The initial system survey includes hardware identifiers, CPU details, RAM, operating-system information, username, machine name and hardware model.
No Persistence Was Observed
Despite configuration suggesting that the malware was designed to operate under the cloudsyncd name, Jamf did not observe it creating a LaunchAgent or LaunchDaemon, installing itself permanently at its configured path or establishing another persistence mechanism during analysis.
That makes it important not to describe the currently observed build as a confirmed persistent implant.
Live Infrastructure Signals Operational Development
Researchers ultimately identified builds communicating with two live domains behind Cloudflare.
More significantly, the analyzed variants shared the same encryption material, string-obfuscation mechanisms, installation paths and internal configuration structure, while primarily changing their C2 endpoints.
CloudSyncD illustrates an important evolution in macOS threats: attackers are combining native Mach-O development, encrypted configuration and attempted fileless execution with something far simpler—persuading users to disable the protections standing in their way.