CloudSyncD Fallback
Jamf’s 30 September report traces CloudSyncD to a counterfeit Zoom installer. A development sample appeared on 15 September; builds configured for live infrastructure followed within two days.
The fallback ran
The installer required a Gatekeeper override, validated a password locally, concealed it in data.json and reused it with sudo. Development and live builds used different paths. In Jamf’s tests, fileless execution failed under System Integrity Protection, but a temporary-file fallback ran and beaconed.
Jamf established no persistence, victim count, actor, Zoom vulnerability or CVE. Its detailed credential-concealment findings do not support a blanket claim that the password was never stored. For affected Macs, isolate the host, rotate credentials and block the published infrastructure.
Sources and context
- Jamf report, 30 September 2026.
- Context: AmnesiaStealer and MacSync are distinct malware.
