[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKHIt47H4yY8VMel-lyKcd9n4w1WYrqDcBFwJoDVi1I0":3},{"article":4,"iocs":45,"watch_terms":65,"solutions":66,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"b3e39fad-bd66-4d48-9a10-9fe952969ebb","macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor","macos-users-targeted-by-fake-zoom-installer-carrying-cloudsyncd-backdoor-174e76","The dropper “carries a complete universal Mach-O inside itself, roughly 756 KB in the development build, and extracts it at runtime. The post macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor appeared first on SecurityWeek.","A new macOS backdoor, dubbed CloudSyncD, has been observed evolving from development to active deployment. Disguised as a legitimate Zoom installer, the malware uses social engineering to trick users into granting it elevated privileges, bypassing macOS System Integrity Protection. Once installed, CloudSyncD establishes a persistent, stealthy backdoor for long-term access and reconnaissance.","macOS users targeted by fake Zoom installer delivering CloudSyncD backdoor.","https:\u002F\u002Fwww.securityweek.com\u002Fmacos-users-targeted-by-fake-zoom-installer-carrying-cloudsyncd-backdoor\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F01\u002FCybersecurity_News-SecurityWeek.jpg","2026-10-02T13:15:00+00:00","2026-10-02T14:01:09.996816+00:00",8,[17,20,22,25],{"name":18,"type":19},"macOS","product",{"name":21,"type":19},"Zoom",{"name":23,"type":24},"Mach-O","technology",{"name":26,"type":24},"System Integrity Protection","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":27,"icon":29,"name":30,"slug":31},null,"Malware","malware",[33,38,40],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46,50,52,56,59,62],{"type":47,"value":48,"context":49},"domain","cloudsyncd.com","Command and Control (C2) domain",{"type":47,"value":51,"context":49},"cloudsyncd.net",{"type":53,"value":54,"context":55},"mitre_attack","T1059.004","Command and Scripting Interpreter: Unix Shell",{"type":53,"value":57,"context":58},"T1547.001","Boot or Logon Autostart Execution: Registry Run Keys \u002F Startup Folder",{"type":53,"value":60,"context":61},"T1071.001","Application Layer Protocol: Web Protocols",{"type":53,"value":63,"context":64},"T1027","Obfuscated Files or Information",[18,21],{"controls":67,"vendors":150},[68,94,123],{"slug":69,"name":70,"problem":71,"products":72},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[73,81,86],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":82,"product_name":83,"url":84,"description":85},"ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"slug":95,"name":96,"problem":97,"products":98},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":124,"name":125,"problem":126,"products":127},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[128,135,143],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":124,"product_name":132,"url":133,"description":134},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":144,"product_name":147,"url":148,"description":149},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[],{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":168},"fake-zoom-installer-deploys-macos-backdoor-via-social-engineering","Fake Zoom Installer Deploys macOS Backdoor via Social Engineering","Attackers disguised malware as a legitimate Zoom installer to trick macOS users into voluntarily granting elevated privileges, enabling the CloudSyncD backdoor to bypass System Integrity Protection (SIP). The root failure is a lack of user security awareness — victims were manipulated into doing the attacker's work for them. Once installed, the backdoor achieves persistence and long-term reconnaissance, meaning the damage compounds over time if not detected early. This attack highlights that even strong OS-level protections like SIP can be circumvented when users are socially engineered into bypassing them. Organizations that do not enforce software installation policies or monitor for unauthorized processes leave themselves exposed to prolonged, stealthy compromise.",[156,157,158,159,160,161,162,163,164,165,166,167],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 14: Security Awareness and Skills Training","CIS Control 10: Malware Defenses","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 AT-2: Literacy Training and Awareness","NIST SP 800-53 CM-7: Least Functionality","NIST CSF DE.CM-4: Malicious code is detected","MITRE ATT&CK T1566: Phishing (Initial Access)","MITRE ATT&CK T1543: Create or Modify System Process (Persistence)","MITRE ATT&CK T1548: Abuse Elevation Control Mechanism",{}]