CloudSyncD MacOS Backdoor Hides Behind Fake Zoom Installer

A new macOS backdoor has been hidden inside a fake Zoom installer that prompts users for their login password before launching an embedded second stage.

The malware, dubbed CloudSyncD, has moved from development testing to samples configured against live command-and-control (C2) infrastructure.

Jamf Threat Labs first encountered CloudSyncD on September 15 in a build that was still under development, according to research published September 30. Two days later, it found samples configured against live C2 infrastructure across more than one domain, indicating the operation had progressed toward deployment.

The malware arrives as a disk image designed to resemble a legitimate Zoom installer. Its instructions tell users to override macOS security protections through the System Settings interface, guiding them around Gatekeeper.

The installer then presents a fake authorization prompt and validates the supplied password against the local account.

Jamf said the password is never sent anywhere. Instead, CloudSyncD buries it in a decoy configuration file, using zero-width Unicode characters to mark where it sits.

Two-Stage macOS Malware Delivery

The password is then used to launch the second stage with elevated privileges. Jamf said the embedded payload is a universal Mach-O binary supporting both Apple silicon and Intel Macs.

The backdoor attempts to execute the payload through /dev/fd to avoid writing the binary to disk. When that approach failed during Jamf's testing, the malware wrote the payload temporarily and launched it using sudo with the harvested password.

CloudSyncD establishes a hidden working directory under the user's home folder and is configured to operate under the name cloudsyncd. Its C2 communication uses encrypted traffic and sends an initial host survey containing system information before subsequent check-ins carry the machine's hardware identifier.

Read more on macOS malware: New MacOS Malware Exploits Legitimate Developer ID to Pose as Apple Crash Reporter

A Backdoor Rather Than an Infostealer

Despite its password prompt, CloudSyncD does not appear to be a conventional credential stealer. Jamf said the malware did not contain built-in functionality for collecting browser data, Keychain items or cryptocurrency wallets, and the captured password was used to facilitate execution of the second stage.

The implant's remote task execution capability allows its operator to deliver executable files or compressed archives for execution. Jamf did not observe persistence. It also never saw the implant install itself as cloudsyncd, a step it said was not reached because no task was delivered during its analysis.

Jamf found CloudSyncD through VirusTotal monitoring and did not report any confirmed infections. 

Image credit: DANIEL CONSTANTE / Shutterstock.com