Fake Zoom Installer Deploys CloudSyncD macOS Backdoor and Hides Password in Zero-Width Unicode

Threat Labs identified CloudSyncD, a macOS backdoor delivered via a fake Zoom.dmg installer that tricks users into bypassing Gatekeeper, captures admin credentials through a fake authorization prompt (stored obfuscated in a local config), and deploys a two-stage Mach-O implant that persists under ~/.local/share/cloudsync/appd, beacons to attacker-controlled C2 domains (/macos/jquery.js), and can receive and execute additional payloads remotely.