The Failed Launch Did Not Stop the Backdoor
Jamf’s 30 September 2026 report traces CloudSyncD to a counterfeit Zoom application. A development sample appeared on 15 September; builds aimed at operational endpoints followed two days later.
The fallback ran
The installer required a Gatekeeper override, validated a password locally, concealed it in data.json and reused it with sudo. The credential file used separate configuration directories in the prototype and operational versions. In controlled testing, execution through an unnamed descriptor failed under System Integrity Protection. A disk-backed alternative still ran and beaconed.
Persistence was not observed during those tests. The report identifies no victim count, actor, flaw in the impersonated product or CVE. Its detailed credential-concealment findings do not support a blanket claim that the password was never stored. For affected Macs, isolate the host, rotate credentials and block the published infrastructure.
Sources and context
- Primary research.
- Context: AmnesiaStealer and MacSync are distinct malware.
