CloudSyncD is macOS malware distributed via a malicious Zoom installer disk image that mounts as a volume named Zoom. The dropper contains a universal Mach-O payload extracted and executed at runtime. Due to macOS System Integrity Protection, the dropper collects the victim's password during activation to execute the payload with sudo privileges. The malware runs as a daemon named CloudSyncD, with encrypted configuration decrypted at runtime. It performs host profiling, reconnaissance, and exfiltrates system and user details to C2 servers hosted behind Cloudflare. The malware uses string obfuscation and disguises its network traffic as jQuery script fetches. Initial samples were in development with private network C2 addresses and verbose logging; later builds have reached deployment with public C2 domains. The malware does not exfiltrate the phished password but uses it locally to escalate privileges. This demonstrates evolving macOS malware techniques emphasizing native implementation, stealth, and social engineering for privilege escalation.

Successful infection results in a persistent, stealthy backdoor on the victim's macOS system, allowing attackers long-term access and control. The malware conducts host profiling and reconnaissance and exfiltrates system and user information to its C2 infrastructure. It enables attackers to deploy follow-up payloads. The malware relies on social engineering to trick users into providing their password, which is used locally to gain root privileges. No direct evidence of password exfiltration or immediate destructive actions is reported.

No official patch or vendor advisory is provided for this malware. Mitigation focuses on user awareness to avoid downloading and executing software from untrusted sources, especially installers masquerading as legitimate applications like Zoom. Since the malware requires user activation and password entry, educating users to verify software authenticity and avoid entering credentials into untrusted prompts is critical. Monitoring for known indicators of compromise (IOCs) provided by researchers can assist detection. Apple’s System Integrity Protection may block some execution attempts, but attackers bypass this by using stolen credentials locally. Applying the latest macOS security updates is recommended to maintain system defenses.