Back Ground.News

New macOS malware masquerades as Zoom installer

Ground.News • September 30, 2026

Jamf Threat Labs has posted a report on CloudSyncD, new malware that attacks macOS.

CloudSyncD, a Mac Malware that Pretends to Be an Zoom Installer

Macworld Jamf Threat Labs has posted a report on new malware that attacks macOS. The malware installer presents itself as a Zoom installer that actually installs the app, but it also installs an infostealer dubbed CloudSyncD that works in the background to capture data and send it to the attacker. The installation is presented as an app icon that is dragged to the macOS Applications folder, a common method of installation. Howev…

There is no tracked Bias information for the sources covering this story.

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New macOS Malware CloudSyncD Disguised as Zoom Installer CloudSyncD is a newly identified macOS malware that masquerades as a legitimate Zoom installer. Discovered by Jamf Threat Labs, it operates as a backdoor, capturing the user's administrator password and allowing remote command execution. The malware is delivered via a disk image named 'Zoom' that prompts users to bypass macOS's Gatekeeper security. Once installed, it can send data to attackers and execute additional malicious commands. The malware does not collect browser data or access keychain items, focusing instead on maintaining a low profile until further access is needed. It affects both Apple Silicon and Intel Macs. The attack vector relies on social engineering to trick users into providing their passwords. Current reports indicate that the malware is actively being deployed. 4 sources 62

Extracted Entities

New macOS malware masquerades as Zoom installer

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)