Security researchers at Jamf Threat Labs identified a new macOS malware strain dubbed CloudSyncD. The malicious software disguises itself as a Zoom installer to compromise systems. It lures users into bypassing the built-in Gatekeeper security mechanism by following fake installation instructions provided on phishing websites.
The malware prompts users to navigate to System Settings and manually override security protocols to run the application. Once the user enters their administrator password, the installer verifies the credentials against the local account. If the password is correct, the malware stores it in a disguised configuration file using hidden Unicode characters.
CloudSyncD operates by establishing a hidden backdoor that grants attackers administrative access. The malware periodically contacts a remote server every 8 to 16 seconds to fetch new commands. This connection allows attackers to deploy additional executable files or compressed archives to the infected machine.
Experts advise users to download software exclusively from the official App Store to mitigate risks. They emphasize that legitimate macOS applications rarely require administrator passwords during installation. Users should remain cautious of prompts that demand security setting changes or repeated credential verification.
