New CloudSyncD macOS Backdoor Uses Fake Zoom Installer to Steal Passwords

The CloudSyncD backdoor exploits user trust by masquerading as a legitimate Zoom installer, tricking victims into voluntarily bypassing macOS Gatekeeper protections. This is a classic supply chain impersonation attack — users believe they are installing trusted software but are instead deploying malware that steals credentials and establishes persistent C2 access. The root failure is a lack of security awareness combined with inadequate software sourcing controls, as users downloaded installers from unverified sources. Once credentials are exfiltrated, the blast radius extends well beyond the initial infection, potentially compromising cloud accounts, corporate systems, and sensitive personal data.