Fake Zoom Installer Tricks Mac Users Into Installing New CloudSyncD Backdoor

A fake Zoom installer is tricking Mac users into handing over their login passwords and launching CloudSyncD, a newly identified backdoor. The malware hides inside an application that looks familiar, using installation instructions and counterfeit prompts to turn routine setup into a privileged infection. The first sample appeared on September 15, 2026, while still under development. Within two days, researchers found related builds pointing to reachable command servers across two domains, suggesting a move toward deployment. The report does not establish infection numbers, affected organizations, or confirmed downstream losses. Jamf Threat Labs researchers identified the malware during routine monitoring of executables uploaded to VirusTotal. Jamf said in a report shared with Cyber Security News (CSN) that CloudSyncD uses two stages,…