CERT24CloudSyncD macOS backdoor hides behind a fake Zoom installerLoading data…
CERT24Threat Observatory
Period

CloudSyncD macOS backdoor hides behind a fake Zoom installer

The new macOS backdoor CloudSyncD is hidden inside a fake Zoom installer. The installer prompts users for their login password before launching an embedded second stage. Jamf Threat Labs found samples configured to use live command-and-control (C2) infrastructure, but reported no confirmed infections.

← Back to intelligence

CloudSyncD macOS backdoor hides behind a fake Zoom installer

The new macOS backdoor CloudSyncD is hidden inside a fake Zoom installer. The installer prompts users for their login password before launching an embedded second stage. Jamf Threat Labs found samples configured to use live command-and-control (C2) infrastructure, but reported no confirmed infections.