macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor

According to Security Affairs, Jamf Threat Labs discovered CloudSyncD during routine VirusTotal scanning and found it concealing a phished password with invisible Unicode characters. SecurityWeek reports that the malicious installer contains a complete universal Mach-O executable, roughly 756 KB in its development build, which it extracts at runtime.

• Security Affairs reports researchers first spotted it on September 15, while it was still under construction.

Covered by 2 publishers within 26 hours of the first report.

Reporting2

SW SecurityWeek macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor · Kevin Townsend 9:15 AM

SAF Security Affairs Fake Zoom installer hides macOS backdoor CloudSyncD · Pierluigi Paganini 11:11 AM

Related

IMP Apple plans stricter consent controls for Mac Full Disk Access October 2

9M SpaceXAI releases a separate Grok iOS app for enterprise users October 1

AI Apple SouthGate reopening on October 23 October 2

TNW Google lifts the Pixel 10a price to $599 as memory costs climb October 2

Topics Apple