Jamf Threat Labs reported CloudSyncD, a new macOS backdoor that spreads through a fake Zoom installer and beacons to its server every 8 to 16 seconds. First caught as a VirusTotal sample that looked unfinished, it now appears in builds that connect to live infrastructure in what Jamf calls an active campaign.
Perspective Coverage
5 publishers
- Builder
- Builder 25%
- Operator
- Operator 70%
- Investor
- Investor 5%
Reality
- Evidence70
- Adoption15
- Hype gap+15
- Incentives
- Not scored
- Confidence68
buildOne report1 publisher Bundling Node left 24 dylib references pointing at /opt/homebrew
The installer launched fine on the build machine and quit in about a second on a Mac that had never run Homebrew. Getting it to start took 26 dylibs copied into the bundle, every path rewritten to @loader_path, and an ad hoc re-sign.
Reality
- Evidence55
- Adoption8
- Hype gap+12
- Incentives45
- Confidence55
buildOne report1 publisher Signing and licensing took as long as the code in a two-day Mac menu bar app
A menu bar copy of the iPhone Duo status ring went on sale two days after Apple showed it, and the day that was not spent writing Swift went to certificates, license keys, self-update and one permission prompt the app declines to trigger.
Reality
- Evidence52
- Adoption18
- Hype gap+6
- Incentives45
- Confidence55
Fake macOS troubleshooting posts route infostealers past Gatekeeper
Microsoft says the campaign now delivers its payload through a command pasted into Terminal rather than a .dmg installer. The review step that mattered was tied to that older delivery method, and the attackers no longer need it.
Reality
- Evidence64
- Adoption52
- Hype gap+8
- Incentives68
- Confidence60
buildOne report1 publisher PyInstaller exits zero, then the real work starts: notarization traps that report success
One engineer's log of shipping a Python app to macOS and Windows beta users. Three checkpoints in the signing pipeline hand back a pass on builds that users cannot open.
Reality
- Evidence58
- Adoption24
- Hype gap−5
- Incentives30
- Confidence46