New macOS Malware CloudSyncD Disguised as Zoom Installer

• •CloudSyncD disguises itself as a Zoom installer to trick users.
• •It captures administrator passwords to enable remote command execution.
• •The malware targets both Apple Silicon and Intel Macs.

CloudSyncD is a newly identified macOS malware that masquerades as a legitimate Zoom installer. Discovered by Jamf Threat Labs, it operates as a backdoor, capturing the user's administrator password and allowing remote command execution. The malware is delivered via a disk image named 'Zoom' that prompts users to bypass macOS's Gatekeeper security. Once installed, it can send data to attackers and execute additional malicious commands. The malware does not collect browser data or access keychain items, focusing instead on maintaining a low profile until further access is needed. It affects both Apple Silicon and Intel Macs. The attack vector relies on social engineering to trick users into providing their passwords. Current reports indicate that the malware is actively being deployed.