A macOS dropper has been found inside a disguised Zoom client. The malware is tracked as CloudSyncD and is designed to deliver a persistent and stealthy backdoor.
Researchers at Jamf first noticed this malware still in development in mid-September. Within days, other samples were found suggesting it has now progressed from testing and development to deployment.
The malware infection process is initiated by any of the standard social engineering methods designed to persuade or trick victims into downloading dangerous content. In this case it is malware hidden in malicious code disguised as a Zoom Mac installer. If the phish is successful, a malware dropper is delivered to the victim as a disk image that mounts as a volume named Zoom. This dropper contains the payload but must be activated by the victim – hence the disguise as a Zoom installer. The victim is guided through the activation thinking it will install Zoom, but it actually installs CloudSyncD.
The dropper “carries a complete universal Mach-O inside itself, roughly 756 KB in the development build, and extracts it at runtime. The same payload is also present on disk inside the application bundle, so the dropper has two sources for it,” say the researchers.
The payload is written to an anonymous file descriptor, and the dropper attempts to execute it. Execution will fail in most cases because of the MacOS System Integrity Protection. If so, the dropper writes the file temporarily to disk and executes it using sudo along with the user’s password collected during the activation process.
The result of successful activation is implementation of the CloudSyncD malware. Its configuration is stored encrypted in the binary and decrypted at runtime. It runs through a daemon named CloudSyncD. The malware first analyzed by the researchers had not reached deployment stage. The C2 address was on a private network, and verbose debug logging was left on.
Now, however, the researchers have seen several malware builds on two separate domains. The URI path is identical in both, masquerading as a jQuery script so a beacon resembles an ordinary JavaScript fetch. Both domains were registered in 2011 through the same registrar and sit behind Cloudflare, and neither carried any detections at the time of writing.
“Every build shares the same string obfuscation table, the same install paths, daemon name and process disguise, and, more tellingly, the same C2 key and initialization vector, down to the identical per-string seeds,” say the researchers. “Only the endpoint changes. Captured beacon traffic is therefore decryptable with material recovered from any build, and the on-host indicators hold across all of them.”
This discovery and analysis of new malware from development to deployment demonstrates how macOS malware continues to move toward native implementations, string protection, and execution paths that attempt to avoid writing payloads to disk – while still depending on the oldest attacker technique available: socially engineering victims to hand over their password.
CloudSyncD serves as a persistent backdoor designed to establish stealthy, long-term access to the infected Mac allowing attackers to deploy follow-up payloads. It conducts host profiling and reconnaissance and exfiltrates system and user details to its C2. It appears in initial delivery process to be similar to an infostealer, but this is not an infostealer in function. It contains no standard infostealer information-stealing functionality. The phished user password, for example, is not exfiltrated but solely used locally to grant root privileges for executing the ongoing backdoor.
Since the malware has now reached deployment, the researchers also provide a long list of IOCs to monitor.
Related: Apple Patches 200 Vulnerabilities With New iOS 27, macOS Golden Gate 27 Releases
Related: Dozens of WebKit Vulnerabilities Patched With Fresh macOS, iOS Security Updates
Related: Recent macOS Screen Sharing Vulnerability Exploited in Attacks
Related: AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions
