Oreaxe may earn a commission if you buy through links on this page. How we make money.
A fake Zoom installer for macOS walks victims through switching off Apple’s own protection and then uses their password to launch a backdoor, Jamf Threat Labs reported on September 30, 2026. Jamf named the malware CloudSyncD and says its operators moved from a test build to live command-and-control servers within two days.
The trick does not rely on a software flaw. It relies on people following on-screen instructions, which makes it a training problem as much as a technical one.
| What happened | A disguised Zoom disk image tricks users into bypassing Gatekeeper, captures their password and launches a remote-access backdoor |
| Who’s affected | Mac users who download Zoom, or what looks like it, from anywhere other than zoom.us |
| Severity | High for any Mac that runs it: the backdoor can receive and run new programs |
| Status | Active: live builds seen on two command-and-control domains; how victims receive the file is not known |
| What to do now | Install Zoom only from zoom.us, and teach staff never to click Open Anyway for an installer |
What happened
Jamf says it found CloudSyncD while monitoring files submitted to VirusTotal and spotted the earliest sample, still clearly a work in progress, on September 15, 2026. Two days later it found samples of the same family pointed at reachable infrastructure, a sign the operators were moving toward real use.
Jamf has not attributed the malware to any group, and its report does not say how the installer reaches victims. SC Media points out that state-backed groups from North Korea and Iran have used fake Zoom installers before, though nothing ties CloudSyncD to either.
How the fake Zoom installer works
The file is a disk image titled Zoom that looks, at a glance, like every other Mac installer. Its background image, per Jamf, carries numbered setup steps: open System Settings, go to Privacy & Security, click Open Anyway and enter an administrator password. Those steps override Gatekeeper, which blocks the app because it is only ad-hoc signed.
Once launched, the app shows a fake authorization prompt and checks the password against the local account, repeating until the right one is entered. It then hides the password inside a decoy Zoom settings file, using invisible zero-width Unicode characters to mark where the real value sits, while a fake “Downloading Zoom” bar plays.
The second stage travels inside the first. The dropper tries to run it without writing it to disk, falls back to a temporary file when macOS blocks that, and starts it with sudo using the captured password. The implant then profiles the machine, beacons to its server every 8 to 16 seconds, and can receive new programs or archives to run. In the builds analyzed, Jamf saw no persistence such as a LaunchAgent being set up, a point Security Affairs also highlights. Jamf and SC Media add that the malware has no built-in features to collect browser data, keychain items or crypto wallets.
Why it matters for small businesses
Small teams often let staff install their own software, and a video-calling app is one of the first things a new hire or a contractor goes looking for. A search result, a meeting invite or a message with a “Zoom update” link is all it takes to land on the wrong download.
Because the backdoor can fetch and run whatever its operators send next, the first payload is not the whole story. A Mac that ran this installer should be treated as compromised, not merely as one that installed a bad app.
What to do now
- Make one rule clear to everyone: install Zoom only from zoom.us, and other apps only from the vendor’s own site or the Mac App Store, never from a link in an email or chat.
- Tell staff that an installer telling them to open System Settings and click Open Anyway is a red flag. Zoom’s genuine Mac installer comes from zoom.us; if anything asks for this, they should stop and call whoever handles IT.
- If someone has already run a suspicious Zoom installer, disconnect the Mac from the network and compare it against the indicators in Jamf’s report, including a hidden ~/.local/share/cloudsync directory and a data.json file under ~/.config/zoom/. Because the implant runs with administrator rights, plan to back up the data, wipe and reinstall macOS, and change that password anywhere else it was used.
- Where you can, stop everyday accounts from being administrators. A password that cannot run sudo is far less useful to this malware.
- Run dedicated anti-malware on company Macs as an extra layer. Intego is one Mac-focused option (our evaluation). If you manage Macs with an MDM, you can also remove the option to override Gatekeeper, but training remains the main defense.
Oreaxe’s take
CloudSyncD shows where Mac attacks are heading: native code, careful concealment and, at the center of it all, a polite request for the user’s password. Gatekeeper did refuse to open the ad-hoc signed app; the weak point was a set of instructions printed on a background image telling people how to overrule it.
Our view is that small businesses get the best return from two cheap controls: a short list of approved download sources for common apps, and standard rather than admin accounts for daily work. Both blunt this campaign and the next one that copies it.
For a wider look at the threats worth planning for, see 7 cyber threats every small business should plan for.
Sources
- Jamf Threat Labs: CloudSyncD, a two-stage macOS backdoor (September 30, 2026)
- SC Media: Fake Zoom installer delivers new CloudSyncD macOS backdoor (October 1, 2026)
- SecurityWeek: macOS users targeted by fake Zoom installer carrying CloudSyncD backdoor (October 2, 2026)
- Security Affairs: Fake Zoom installer hides macOS backdoor CloudSyncD (October 3, 2026)
Every factual claim links to its source. Spotted an error? Tell us.