A macOS dropper was found in a disguised Zoom client. The malware is tracked as CloudSyncD and is designed to provide a persistent and stealthy backdoor.
Jamf researchers first noticed this still-in-development malware in mid-September. Within days, additional samples were found, indicating that testing and development has now progressed to deployment.
The malware infection process is initiated through one of the standard social engineering methods that aim to trick or trick victims into downloading dangerous content. In this case, it is malware hidden in malicious code and disguised as a Zoom Mac installer. If the phishing is successful, the victim is delivered a malware dropper as a disk image mounted as a volume named Zoom. This dropper contains the payload but must be activated by the victim – hence the disguise as a Zoom installer. The victim is guided through activation thinking they are going to install Zoom, but they are actually installing CloudSyncD.
The dropper “carries a full universal Mach-O, about 756 KB in the development build, and extracts it at runtime. The same payload is also present on disk in the application package, so the dropper has two sources for it.” say the researchers.
The payload is written to an anonymous file descriptor and the dropper attempts to execute it. Execution fails in most cases due to MacOS System Integrity Protection. If this is the case, the dropper temporarily writes the file to disk and runs it with sudo along with the user password collected during the activation process.
The result of successful activation is the implementation of the CloudSyncD malware. Its configuration is stored encrypted in the binary and decrypted at runtime. It runs through a daemon called CloudSyncD. The malware the researchers initially analyzed had not yet reached the deployment stage. The C2 address was on a private network and verbose debug logging was left enabled.
Now, however, researchers have seen multiple malware builds on two separate domains. The URI path is the same in both, masquerading as a jQuery script, so a beacon resembles an ordinary JavaScript call. Both domains were registered through the same registrar in 2011 and are behind Cloudflare. At the time of writing, there have been no detections.
“Each build uses the same string obfuscation table, installation paths, daemon name and process disguise, and, more tellingly, the same C2 key and initialization vector, down to the identical seeds per string,” the researchers say. “Only the endpoint changes. The captured beacon traffic is therefore decryptable with the material recovered from each build, and the indicators on the host apply to all.”
This discovery and analysis of new malware from development to deployment shows how macOS malware continues to move toward native implementations, string protection, and execution paths that attempt to avoid writing payloads to disk – while still relying on the oldest attacker technique available: social engineering victims into giving up their password.
CloudSyncD serves as a persistent backdoor that provides stealthy, long-term access to the infected Mac and allows attackers to deliver follow-on payloads. It performs host profiling and reconnaissance and exfiltrates system and user details to its C2. In the first delivery process, it seems to be similar to an infostealer, but in its function it is not an infostealer. It does not include standard Infostealer functionality for information theft. For example, the fake user password is not exfiltrated but is used exclusively locally to grant root privileges to execute the running backdoor.
Since the malware is now in use, the researchers are also providing a long list of IOCs to monitor.
Related: Apple fixes 200 security vulnerabilities with the new versions of iOS 27 and macOS Golden Gate 27
Related: Dozens of WebKit vulnerabilities fixed with new security updates for macOS and iOS
Related: Current screen sharing vulnerability in macOS has been exploited in attacks
Related: AmnesiaStealer macOS malware steals data and controls browser sessions
