[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-DjzE4fUCIXvTuZmEMDJaQtE_s_bFhDHGGRBsgMo4zM":3},{"article":4,"iocs":42,"watch_terms":46,"solutions":47,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":29},"20120642-10fb-4e5b-98bc-1b9b6892b38e","New CloudSyncD macOS Backdoor Uses Fake Zoom Installer to Steal Passwords","new-cloudsyncd-macos-backdoor-uses-fake-zoom-installer-to-steal-passwords-e05d9b","CloudSyncD macOS backdoor uses a fake Zoom installer to steal Mac passwords, bypass Gatekeeper and connect infected devices to remote C2 servers.","A new macOS backdoor, dubbed CloudSyncD, has been discovered distributing itself via a fake Zoom installer. This malware is designed to steal user passwords and bypass macOS's Gatekeeper security feature. Once infected, devices are connected to command-and-control (C2) servers, allowing attackers to maintain persistent access and exfiltrate sensitive data.","New macOS backdoor CloudSyncD uses fake Zoom installer to steal passwords.","https:\u002F\u002Fhackread.com\u002Fcloudsyncd-macos-backdoor-fake-zoom-installer-passwords\u002F",null,"2026-10-01T15:36:17+00:00","2026-10-01T16:00:25.273731+00:00",8,[17,20,22],{"name":18,"type":19},"macOS","product",{"name":21,"type":19},"Zoom",{"name":23,"type":24},"Gatekeeper","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":25,"icon":12,"name":27,"slug":28},"Malware","malware",[30,35,37],{"category":31},{"id":32,"icon":12,"name":33,"slug":34},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":36},{"id":25,"icon":12,"name":27,"slug":28},{"category":38},{"id":39,"icon":12,"name":40,"slug":41},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[43],{"type":28,"value":44,"context":45},"CloudSyncD","Name of the macOS backdoor",[18,21],{"controls":48,"vendors":133},[49,75,104],{"slug":50,"name":51,"problem":52,"products":53},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[54,62,67],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":63,"product_name":64,"url":65,"description":66},"ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"slug":76,"name":77,"problem":78,"products":79},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[80,88,96],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"slug":105,"name":106,"problem":107,"products":108},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[109,117,125],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",[134],{"slug":135,"name":136,"logo_path":137,"roles":138},"apple","Apple","\u002Fvendor-logos\u002Fapple.png",[139],"affected",{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":158},"fake-zoom-installer-delivers-macos-cloudsyncd-backdoor-to-steal-passwords","Fake Zoom Installer Delivers macOS CloudSyncD Backdoor to Steal Passwords","The CloudSyncD backdoor exploits user trust by masquerading as a legitimate Zoom installer, tricking victims into voluntarily bypassing macOS Gatekeeper protections. This is a classic supply chain impersonation attack — users believe they are installing trusted software but are instead deploying malware that steals credentials and establishes persistent C2 access. The root failure is a lack of security awareness combined with inadequate software sourcing controls, as users downloaded installers from unverified sources. Once credentials are exfiltrated, the blast radius extends well beyond the initial infection, potentially compromising cloud accounts, corporate systems, and sensitive personal data.",[145,146,147,148,149,150,151,152,153,154,155,156,157],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 CM-7: Least Functionality \u002F Application Allowlisting","NIST SP 800-53 AC-4: Information Flow Enforcement","NIST SP 800-161: Supply Chain Risk Management","NIST CSF PR.AT-1: Security Awareness Training","GDPR Article 32: Security of Processing","MITRE ATT&CK T1566: Phishing \u002F Spearphishing via Trojanized Installer","MITRE ATT&CK T1078: Valid Accounts (credential theft follow-on)","ITIL Change Management: Software Deployment Verification",{"GDPR Article 32: Security of Processing":159,"NIST CSF PR.AT-1: Security Awareness Training":160,"NIST SP 800-161: Supply Chain Risk Management":161,"CIS Control 13: Network Monitoring and Defense":162,"NIST SP 800-53 SI-3: Malicious Code Protection":163,"CIS Control 9: Email and Web Browser Protections":164,"NIST SP 800-53 AC-4: Information Flow Enforcement":165,"CIS Control 2: Inventory and Control of Software Assets":166,"CIS Control 4: Secure Configuration of Enterprise Assets":167,"ITIL Change Management: Software Deployment Verification":168,"MITRE ATT&CK T1078: Valid Accounts (credential theft follow-on)":169,"NIST SP 800-53 CM-7: Least Functionality \u002F Application Allowlisting":170,"MITRE ATT&CK T1566: Phishing \u002F Spearphishing via Trojanized Installer":171},"Securing endpoints against credential-stealing malware is part of Article 32's appropriate measures.","Awareness training teaches users to download software only from official sources and never bypass Gatekeeper warnings.","Supply chain risk management includes getting software only from verified vendor sources.","Network monitoring helps detect CloudSyncD's command and control traffic after installation.","Malicious code protection helps detect the CloudSyncD backdoor on macOS endpoints.","Web protections that block known malicious domains help prevent users downloading fake Zoom installers.","Information flow enforcement can block connections to attacker infrastructure used by the backdoor.","A software inventory with approved sources would flag a Zoom installer downloaded from an unofficial site.","Secure configuration that keeps Gatekeeper enforcing and blocks users from overriding it would stop CloudSyncD from running.","Verifying software deployments through change management ensures only approved installers are used.","Stolen passwords are then used as valid accounts, the follow-on technique this entry describes.","Application allowlisting ensures only approved software from trusted sources can run.","Trojanised installers delivered through lures are the initial access route this technique covers."]