Loading malware…
CloudSyncD is a two-stage macOS backdoor distributed through a malicious disk image masquerading as a Zoom installer. Its components are built from C++ and Objective-C, and its embedded universal Mach-O implant supports Intel and Apple silicon Macs. Jamf Threat Labs first identified development samples in September 2026 and subsequently found builds communicating with live command-and-control infrastructure. No specific threat actor has been attributed to the malware.
The installer instructs users to bypass Gatekeeper and presents a counterfeit authorization dialog to capture their local account password. It validates the password locally, then conceals it in a decoy configuration using Base64 encoding, random padding, and invisible zero-width Unicode characters that encode its location and length. The second-stage implant is embedded rather than downloaded. The dropper initially attempts execution through an anonymous file descriptor; when this fails, it writes the implant to a temporary file and uses the captured password with sudo to launch it with elevated privileges. Password exfiltration was not observed.
The implant surveys hardware, operating-system, account, and network information and transmits the results to its command-and-control server. Observed live builds subsequently beaconed every 8–16 seconds. Its tasking mechanism supports decrypting and executing remotely supplied Mach-O binaries or executables packaged in compressed archives, rather than running shell commands directly. Defense-evasion features include obfuscated strings, encrypted configuration and logs, concealed credential storage, and command-and-control requests disguised as JavaScript-resource retrievals.
The analyzed builds lacked built-in browser-data, Keychain, and cryptocurrency-wallet collection functionality. No persistence mechanism, successful application replacement, or delivery and execution of remote tasks was observed during testing.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
22 distinct techniques documented for this family, organized by ATT&CK tactic.
The captured password is concealed inside an apparently ordinary settings file. Its base64-encoded value sits between random filler characters, while 48 invisible Unicode characters appended to the version field identify its position and length.
The password gets written to ~/.config/zoom/data.json... hidden in a “cache” value in a base64-encoded format with randomly generated filler characters... [with] invisible zero-width Unicode characters... hidden within the file’s “version” field.
The Mach-O payload executable gets embedded within the dropper and extracted at runtime.
[The malware] first attempt[s] to execute [the embedded Mach-O payload] via /dev/fd without writing it to the disk.
The password gets written to a file... in a base64-encoded format with randomly generated filler characters placed before and after it.
The disk image and application bundle impersonate Zoom (Zoom.dmg and Zoom.app), presenting a familiar installation layout and counterfeit setup prompts.
The task archive is extracted inside a temporary task directory; the directory is removed after use. The tasked-payload fallback is unlinked after launch, and the bundle-swap script is self-deleting.
The server can return encrypted tasks containing executable programs, either directly or inside compressed archives... /usr/bin/tar xzf -C [is used for] archive extraction.
The final payload... retrieves its command-and-control (C2) address from an encrypted configuration file and beacons every 8 to 16 seconds. The backdoor receives tasks from the C2 server as JSON objects.
Its endpoints imitate requests for a JavaScript library, helping traffic resemble ordinary web activity. Live endpoints use the /macos/jquery.js path.
19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A macOS backdoor delivered through a fake Zoom installer that instructs victims to bypass Gatekeeper. Its dropper repeatedly requests and validates the user's local account password, then conceals the base64-encoded password in a fake settings file using randomized padding and invisible Unicode characters that encode its location. The embedded universal Mach-O payload attempts execution through an anonymous file descriptor; when System Integrity Protection blocks this approach, it falls back to a temporary file executed with sudo using the captured password. The backdoor contacts command-and-control infrastructure every 8–16 seconds with a hardware identifier and can receive compressed archives or complete executables for extraction or execution. Recovered builds did not establish persistence. Shared encryption keys and initialization vectors across samples could potentially enable cross-version traffic decryption.
A two-stage macOS backdoor distributed through a malicious disk image impersonating a Zoom installer. Users are instructed to bypass Gatekeeper, after which the first-stage app_installer presents a fake authorization prompt and validates stolen administrator passwords locally using dscl. It conceals the Base64-encoded password in data.json, using zero-width Unicode characters to encode its location and length. An embedded Mach-O payload supports Intel and Apple Silicon Macs. It attempts execution without initially writing to disk; if blocked, it can use a temporary file and the captured password with sudo to execute with elevated privileges. The backdoor gathers hardware, operating-system, account, and network information, checks its command-and-control server approximately every 8–16 seconds in analyzed samples, and can receive executable files or compressed archives for potential additional malware deployment. Jamf Threat Labs discovered the malware.
A persistent macOS backdoor delivered through a fake Zoom installer distributed using social engineering. Its dropper carries a universal Mach-O payload and attempts execution through an anonymous file descriptor, falling back to temporary disk execution using sudo and the victim's supplied password. CloudSyncD runs as a daemon, decrypts its embedded configuration at runtime, profiles the host, and exfiltrates system and user details to its command-and-control infrastructure. Its beacon requests masquerade as jQuery script fetches. Researchers observed development samples followed by deployment builds. It is not a conventional infostealer: the captured password is used locally for root privileges rather than exfiltrated.
A macOS privileged backdoor distributed through a counterfeit Zoom disk image. It surveys the host and beacons to C2 servers, where it can receive encrypted executable payloads directly or in compressed archives. It captures and locally conceals the user’s password to authenticate privileged execution. The analyzed samples had no observed persistence or completed remote-task delivery.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.