CloudSyncD: Technical Analysis of a Fake Zoom Installer and macOS Backdoor

CloudSyncD is a two-stage macOS backdoor family delivered through a fake Zoom installer. Jamf Threat Labs first encountered the family on September 15, 2026, initially observing a development build before identifying samples configured against reachable command-and-control infrastructure. This progression indicates movement from testing toward deployment, although the available public research does not establish the number of victims, geographic scope or identity of the operators. The infection chain combines social engineering, Gatekeeper-bypass guidance, local password validation, Unicode-based concealment, embedded payload execution and a lightweight C2 implant.

The first stage presents a fake authorization dialog and validates the entered password locally through dscl, then stores the captured credential inside a decoy JSON configuration file. The hidden value is located using zero-width Unicode characters appended to a visible version field. The second stage is embedded inside the dropper and can collect host information, maintain encrypted local logs and process C2 tasking. Importantly, Jamf reports that the password is not sent to the attacker and that the analyzed malware does not include built-in collection of browser data, Keychain items or cryptocurrency wallets.

Jamf Threat Labs first encountered CloudSyncD on September 15, 2026, during routine monitoring of executables in VirusTotal. The initial sample was plainly still under development. After approximately two days of monitoring, researchers identified samples from the same family configured against live command-and-control infrastructure across more than one domain. This indicates movement from testing toward deployment. The public research does not, however, establish the current number of victims or the continuing scale of activity.

The discovery of samples configured against reachable C2 infrastructure demonstrates operational deployment capability. It should not be interpreted as proof of widespread or ongoing compromise as of the publication of this report. No specific cybercriminal group, nation-state or known threat actor has been publicly attributed to CloudSyncD in the Jamf research. The available evidence supports analysis of the malware and its infrastructure, but not reliable actor attribution.

The available research does not provide a confirmed infection count, number of affected organizations, geographic distribution or a specific industry as the primary target. The identified live infrastructure shows that the malware family had progressed beyond a purely local development sample, but there is insufficient evidence to quantify its prevalence or claim broad targeting.

CloudSyncD should be treated as a significant macOS threat because it combines a convincing software-installation lure with credential abuse, privileged execution through sudo, host discovery, encrypted logging and C2-based tasking. However, the available evidence does not establish it as the most sophisticated or widespread macOS malware. Its defensive significance is the combination of user deception and native macOS mechanisms with a backdoor capable of receiving additional executable content. Remote task execution was supported by the code but was not observed during the published detonation.

• The malware is distributed as Zoom.dmg and mounts a volume named Zoom designed to resemble a legitimate installer.
• The application is ad-hoc signed and the disk-image artwork guides the victim through System Settings → Privacy & Security → Open Anyway, effectively coaching a Gatekeeper override.
• The first-stage executable is Zoom.app/Contents/MacOS/app_installer.
• A fake authorization dialog requests the local account password and repeats until validation succeeds.

The password is validated against the local account before the infection proceeds:

/usr/bin/dscl /Local/Default -authonly <user> <password>

The captured password is then placed in ~/.config/<name>/data.json. It is base64-encoded and buried inside a cache value with random filler. The neighbouring version field contains U+200B ZERO WIDTH SPACE and U+200C ZERO WIDTH NON-JOINER characters encoding the offset and length of the hidden value. This means conventional visual review of the JSON can miss the credential-bearing data. Jamf reports that the password is not transmitted to the C2 infrastructure; the credential is used locally to enable the privileged launch of the embedded second stage.

The second stage is a universal Mach-O for Apple silicon and Intel and is carried within the first stage. The dropper first attempts an anonymous file-descriptor execution path through /dev/fd. Jamf reported this attempt failing with return code 13 under the tested macOS protections. The fallback writes the stage to a temporary file and launches it through sudo using the harvested password.

/usr/bin/sudo -S --preserve-env=HOME,USER $TMPDIR/.s_XXXXXX

The dropper can construct a short bash script under $TMPDIR/.app_swap_<pid>.sh to remove or replace an application bundle and reopen it. However, the published analysis did not observe the replacement completing because the required bundle was not present in the recovered builds. Therefore this should be treated as a capability present in the code, not a confirmed action in the observed detonation.

Live-build infrastructure reported by Jamf includes:

• orchid-led[.]com
• bjzhishang[.]com
• Live URI pattern: /macos/jquery[.]js

The development build also contained hxxp://192[.]168[.]2[.]133:9099/ops. The implant's response parser accepts a JSON task field, decodes/decrypts it and can process a gzipped tar archive or raw Mach-O. The published detonation did not observe a remote task being delivered; this is therefore a capability supported by the code rather than a confirmed action during the test.

• Hunt for Zoom.dmg and suspicious ad-hoc signed Zoom-like applications originating from user-writable locations.
• Detect execution of /usr/bin/dscl ... -authonly where process telemetry captures command-line arguments.
• Inspect JSON files for U+200B/U+200C zero-width characters combined with base64-like values.
• Hunt for ~/.local/share/cloudsync/ and sync.err.
• Monitor $TMPDIR/.app_swap_* and $TMPDIR/.s_* artifacts.
• Correlate DNS/proxy/EDR connections to orchid-led[.]com and bjzhishang[.]com.
• Alert on sudo launching temporary Mach-O files from user application/temp paths.
• Review unexpected ioreg and tar child processes originating from suspicious application bundles.
• Where compromise is suspected, isolate the host, preserve evidence and rotate credentials accessible from the endpoint.

• Contain — isolate the endpoint and preserve volatile/network evidence.
• Credential reset — reset the local password and credentials/tokens accessible from the host.
• Scope — search hashes, domains, paths, process patterns and Unicode artifacts.
• Privilege review — identify commands launched through sudo and determine what executed with elevated rights.
• Persistence review — inspect LaunchAgents, LaunchDaemons, login items and other startup mechanisms.
• Network review — reconstruct connections to identified infrastructure and identify additional endpoints.
• Recovery — remove malicious components only after evidence collection; rebuild the host if trust cannot be restored.

CloudSyncD demonstrates a deliberate macOS infection chain that relies less on an advanced exploit and more on social engineering plus native operating-system mechanisms. The most important defensive anchors are the fake Zoom delivery mechanism, ad-hoc signing, password validation with dscl, zero-width Unicode concealment, temporary Mach-O execution through sudo, hidden filesystem artifacts and C2 behavior.

Detection should therefore prioritize behavioral correlation rather than a single IOC. A host showing several of these signals together warrants investigation even if the exact sample hash is not present.

Primary source: Jamf Threat Labs, "CloudSyncD: a two-stage macOS backdoor that hides a phished password in zero-width Unicode," published September 30, 2026.