Fake Zoom installer talks macOS users past Gatekeeper to drop CloudSyncD backdoor

A new macOS backdoor dubbed CloudSyncD gains initial access through a fake Zoom installer, Jamf Threat Labs researchers reported Wednesday.

The malware was first discovered through a VirusTotal sample and initially appeared still in development, but more recent samples were found to connect to live infrastructure, which Jamf said suggests an active campaign.

The fake installer is a disk image that mounts as a volume under the name Zoom and displays instructions designed to convince the victim to override Gatekeeper by manually clicking Open Anyway in security settings.

The final payload runs as a universal Mach-O implant that retrieves its command-and-control address from an encrypted configuration file and beacons every 8 to 16 seconds.

It also displays a prompt for the user to enter their password and validates the password using dscl.

On execution the implant creates a working tree, begins writing logs to ~/.local/share/cloudsync/.config/logs/sync.err and sends a survey of host information to the remote server.

While the user sees a fake progress window making it appear Zoom is downloading, their password is written to a file under ~/.config/zoom/ named data.json that looks like a normal Zoom config file but hides the password in a cache value in base64 with randomly generated filler characters before and after it.

The malware encodes the password's length and offset using two invisible zero-width Unicode characters, the U+200C zero width non-joiner and the U+200B zero width space, in the file's version field, so the number of each tells the attacker where to find the base64 password among the filler.

Jamf said the malware does not act as an infostealer and does not target browser data, keychain items or cryptocurrency wallets; it only steals the user's password to further its attack chain and does not appear to exfiltrate it.

The malware does not use persistence mechanisms such as LaunchAgent or LaunchDaemon plists.

The backdoor receives tasks from the C2 server as JSON objects and executes any raw Mach-O it receives; it also accepts gzipped tar archives, which it unpacks with /usr/bin/tar.

"Tasking delivers executables, not shell commands, so the observable is a newly written or fileless Mach-O rather than suspicious shell activity," the Jamf researchers wrote.

"CloudSyncD is a good reminder that although infostealers may dominate the threat landscape, attackers still have use for quieter malware that lies low until further access is needed," the researchers concluded.

Using fake Zoom installers to spread malware is a common tactic in job recruitment or business meeting themed attacks, and the technique has previously been used by North Korean and Iranian state-sponsored threat actors.

Jamf has not attributed CloudSyncD to any specific threat actor.