Jamf CloudSyncD (30 Sep): fake Zoom.dmg macOS backdoor — Gatekeeper bypass lure + zero-width password hide
Jamf Threat Labs (30 September 2026; Cyber Security News / 9to5Mac amplify 1 Oct) details CloudSyncD, a two-stage macOS backdoor delivered as an ad-hoc-signed Zoom.dmg that mounts a fake Zoom installer and walks victims through Privacy & Security → Open Anyway to bypass Gatekeeper. Stage one (app_installer) phishes the login password via a fake AuthDialog, validates with dscl (credential visible in argv), conceals the base64 password inside ~/.config/zoom|cloudsync/data.json using U+200B/U+200C zero-width index on the version field, then launches an embedded universal Mach-O via failed /dev/fd attempt then sudo -S mkstemp. Stage two (cloudsyncd / appd) beacons every 8–16s; live C2 orchid-led[.]com and bjzhishang[.]com under /macos/jquery.js (Cloudflare). Password is used for privileged launch only — not exfiltrated; implant surveys host and accepts tasked Mach-O/tar executables. First seen 15 Sep (dev build); live infra within two days. No attribution. Primary: Jamf; wire: CSN 1 Oct.
- Product
- macOS (CloudSyncD backdoor via fake Zoom.dmg; Apple silicon + Intel)
- Versions
- n/a (malware family; no product CVE). Hunt Zoom.dmg SHA-256 faf2eea05f3c9f1c4ef8f6be339f5459a38f95cfd9d512bc24e2803230e5c7bf; paths ~/.local/share/cloudsync/, ~/.config/zoom|cloudsync/data.json (U+200B/U+200C); C2 orchid-led[.]com / bjzhishang[.]com /macos/jquery.js; dscl -authonly and sudo -S $TMPDIR/.s_* command lines
- Exploited in Australia?
- unknown
- Patch to
- Install Mac apps only from App Store or trusted vendor sites; do not follow Open Anyway instructions from unsigned DMGs. Jamf: threat prevention / advanced threat controls / web protection Block+Report. Hunt zero-width Unicode in JSON configs, cloudsyncd process disguise, and the C2/path IoCs in the Jamf blog.
Primary: Jamf Threat Labs — CloudSyncD fake Zoom macOS backdoor (30 Sep 2026) · Vendor: Jamf Threat Labs (primary) · SC Media — CloudSyncD fake Zoom installer (30 Sep / 1 Oct 2026 amplify)