New CloudSyncD macOS Backdoor Uses Fake Zoom Installer to Steal Passwords

Jamf Threat Labs identified CloudSyncD, a previously undocumented macOS backdoor distributed in a fake Zoom installer that tricks users into entering their passwords, stores base64-encoded credentials in a disguised config file, and uses those credentials to launch a second-stage 'cloudsyncd' backdoor which collects host information and checks in frequently with command-and-control servers; Jamf observed development and reachable C2 infrastructure but did not see persistence mechanisms or typical infostealer capabilities.