macOS CloudSyncD Backdoor Deploys via Fake Zoom DMG, Extracts Mach-O to Anonymous FD Then Escalates with Captured sudo Password

The dropper mounts as a Zoom volume, extracts its payload to an anonymous file descriptor, and falls back to writing to disk only when SIP blocks execution; it then re-launches via sudo using the password collected during the fake installer flow. Jamf researchers documented the transition from verbose debug builds to stripped deployment samples sharing the same per-string seeds, daemon name CloudSyncD, and jQuery-masqueraded beacon paths on two 2011-registered domains. Technical indicators remain consistent across samples, allowing full decryption of captured traffic from any single build. Evidence shows the operator prioritizes native Mach-O execution and minimal disk writes while still relying on the classic social-engineering vector of tricking users into supplying local credentials. This pattern matches recent macOS campaigns tracked by SentinelOne and Objective-See that favor persistence via LaunchDaemons over deprecated methods. The malware performs host reconnaissance and exfiltration but lacks typical infostealer modules, indicating its role is long-term access rather than immediate data theft. The shift to production C2 on infrastructure registered over a decade ago and protected by Cloudflare reduces early detection windows. macOS users who bypass Gatekeeper for any productivity tool remain the highest-risk cohort; the same credential-escalation technique can be reused against future droppers. Monitoring for CloudSyncD daemon creation and the two known domains provides the immediate detection surface. Next, expect the operator to rotate only the endpoint while retaining the shared key material, producing detectable traffic until the key is changed.