Jamf Threat Labs has posted a report on new malware that attacks macOS.
CloudSyncD is a fake Zoom installer disguised as a legitimate application that uses a phished login password to launch an embedded backdoor while concealing the credential inside a decoy configuration file. Although it might look like an infostealer at first, due to the way it prompts the user for their password, the password is never recorded or sent anywhere. The malware doesn’t contain built-in features to collect browser data, keychain items or cryptocurrency wallets.
From the Jamf Threat Labs report: CloudSyncD arrives as a disk image that mounts as a volume named Zoom, laid out to look like any ordinary Mac installer: an application icon on the left, an alias to Applications on the right. The difference is the background image, which carries a numbered Setup list telling the victim to open System Settings, go to Privacy & Security, scroll to the Security section, click Open Anyway, and enter their administrator password.
Those are instructions to bypass Gatekeeper. The bundle is ad-hoc signed, so macOS will refuse to launch it on a double-click, and the artwork walks the user through overriding that refusal by hand.
Jamf Threat Labs says CloudSyncD is a good reminder that although infostealers may dominate the threat landscape, attackers still have use for quieter malware that lies low until further access is needed.
“Its behaviors illustrate how macOS malware continues to move toward native implementations, string protection, and execution paths that attempt to avoid writing payloads to disk, while still depending on the oldest technique available: asking the user for their password,” the report says.
In Jamf for Mac, customers can configure threat prevention, advanced threat controls and web protection to Block and Report to help prevent the execution of similar threats.
I hope you’ll help support Apple World Today by becoming a patron. Almost all our income is from Patreon support and sponsored posts. Patreon pricing ranges from $2 to $10 a month. Thanks in advance for your support.
