Attackers are targeting Mac users with a fake Zoom installer that secretly installs a backdoor called CloudSyncD. The malware is delivered in a disk image masquerading as a Zoom app, then tricks the user into authorizing installation with their password so it can run with elevated privileges. Jamf says CloudSyncD is a persistent backdoor, not a typical infostealer: it profiles the host, exfiltrates system and user details, and beacons to command-and-control servers hidden behind Cloudflare.
Why it matters: Mac users and organizations should be wary of Zoom installers from anywhere other than Zoom or trusted app-management channels, because the malware relies on users handing over their password. Defenders should hunt for the CloudSyncD daemon, related install paths, and suspicious Zoom-branded disk images, and review Macs for persistence and outbound connections to the identified infrastructure.
Kevin Townsend
2026.10.02
100% relevant
This article appears to be the first tracked report establishing the CloudSyncD fake-Zoom macOS backdoor campaign as a distinct malware/social-engineering story.
← Back to all stories