Fake Zoom installer tricks Mac users into disabling Gatekeeper

Jamf Threat Labs discovered CloudSyncD, malware disguised as a Zoom installer. It walks users through disabling Gatekeeper and entering their admin password, then opens a hidden backdoor on the Mac.

• Malware found on VirusTotal on September 15 and named CloudSyncD
• Installer tells users to disable Gatekeeper and enter admin password
• Password is hidden in a fake Zoom config using invisible Unicode characters
• Backdoor runs on Apple Silicon and Intel, polling for commands every 8–16 seconds