Jamf researchers have identified a new macOS backdoor called CloudSyncD that has recently moved from development into active deployment. The malware is delivered via social engineering as a fake Zoom installer where victims are lured into downloading a disk image that mounts as “Zoom” and running an installer they believe will install Zoom, but instead installs CloudSyncD. The dropper carries a full universal Mach-O payload, writes it to an anonymous file descriptor, and tries to execute it. When macOS System Integrity Protection blocks this, it temporarily writes the payload to disk and runs it with sudo using the user’s password collected during the “installation.” That password is not exfiltrated, but rather it is used locally to gain root and set up a persistent daemon named CloudSyncD. CloudSyncD stores its configuration encrypted, uses string obfuscation, disguises its beacon as a jQuery fetch to two (2) Cloudflare protected domains, and performs host profiling and data exfiltration, serving as a stealthy long term backdoor rather than a classic infostealer. Jamf has published extensive IOCs to help defenders detect it, which CTIX Analysts have linked below.