A new Mac threat is hiding inside something that looks like a normal Zoom installer, according to security researchers at Jamf Threat Labs.
The file opens as a disk named Zoom and looks like the usual Mac installer: an app icon on the left, a shortcut to the Applications folder on the right. The catch is a set of instructions printed on the background of that window. They tell the user to open System Settings, go to Privacy & Security, click Open Anyway, and enter an administrator password.
Those steps are how the attack gets past Apple’s Gatekeeper, which would otherwise block the file because it is not properly signed by a trusted developer. Once the user follows the instructions, a fake password prompt appears. The installer checks the password against the Mac account and keeps asking until it is correct. A window then says Zoom is downloading, even though researchers did not see a real Zoom install complete in the samples they tested.
The password is used on the machine to launch a hidden second program that Jamf is calling CloudSyncD. It works on both Apple silicon and Intel Macs. After it starts, it sends basic details about the computer to the attacker and checks back every few seconds for new instructions. Those instructions can include more software for the attacker to run later.
Jamf first spotted an unfinished version of CloudSyncD on September 15th. Within two days, later samples were talking to live servers, a sign the operation had moved past testing. In the versions researchers examined, the malware did not set itself to restart after a reboot, and it did not appear to steal browser passwords or wallet data on its own. The immediate goal is quiet access to the Mac.
MacDailyNews Take: The safest defense is also the simplest. Download Zoom, and other apps, only from the Mac App Store or the developer’s own site. If an installer tells you to click Open Anyway and type your password, close it.
Please help support MacDailyNews — and enjoy subscriber-only articles, comments, chat, and more — by subscribing to our Substack: macdailynews.substack.com. Thank you!
Support MacDailyNews at no extra cost to you by using this link to shop at Amazon.
