CloudSyncD MacOS Backdoor Hides Behind Fake Zoom Installer

## Executive summary Jamf Threat Labs identified CloudSyncD, a two-stage macOS backdoor disguised as a fake Zoom installer that tricks users into providing their login password to launch an embedded Mach-O second stage with elevated privileges; the implant uses encrypted C2, hides under a cloudsyncd directory, can remotely execute delivered payloads, and was observed in samples configured against live C2 domains although Jamf saw no confirmed infections.