Fake Zoom installer hides macOS backdoor CloudSyncD

Jamf Threat Labs analyzed CloudSyncD, a macOS backdoor disguised as a fake Zoom installer that repeatedly prompts victims for their macOS password, hides the captured password using zero-width Unicode characters inside a benign-looking settings file, and uses that password to execute an embedded Mach-O payload (attempting fileless execution or falling back to writing a temporary file and invoking sudo). The implant performs periodic C2 check-ins, can receive compressed archives or full executables for execution, and was observed moving from test infrastructure to live domains, demonstrating active development and operational capability.