Researchers Uncover Hidden macOS Zoom Installer Carrying CloudSyncD Backdoor

Security researchers at Jamf Threat Labs have identified a malicious macOS application masquerading as a Zoom installer, which they have named CloudSyncD. The counterfeit installer embeds a backdoor that captures user credentials and conceals them using invisible zero‑width Unicode characters, making detection by traditional scanning tools more difficult.

The discovery was made during a routine analysis of files submitted to VirusTotal, where the team noticed an anomalous Zoom client bundle. Further inspection revealed that the package contained hidden code that, once executed, siphons a victim's password and stores it in a format that blends into normal text, leveraging zero‑width characters to evade visual inspection.

Zoom’s widespread adoption for remote work and virtual meetings has made it a frequent target for cyber‑criminals seeking to exploit the trust users place in the platform. By presenting a seemingly legitimate installer, attackers aim to trick users into granting the malicious software the same permissions that a genuine Zoom client would receive, potentially opening a pathway to broader system compromise.

The use of zero‑width Unicode characters as an obfuscation technique is not new, but its application in a macOS backdoor underscores the evolving sophistication of threat actors targeting Apple devices. These characters are invisible in most text editors and browsers, allowing malicious strings to blend seamlessly with benign data, thereby hindering both manual review and automated detection.

Jamf Threat Labs’ findings highlight the importance of verifying software sources, especially for widely used applications. Users are advised to download installers directly from official vendor websites or trusted app stores, and to employ reputable endpoint protection solutions that can flag anomalous behavior even when traditional signatures are absent.

The incident adds to a growing list of macOS‑specific threats that leverage social engineering and advanced obfuscation. While no public reports indicate widespread exploitation of CloudSyncD at this time, the researchers have shared indicators of compromise with the broader security community to aid in early detection and mitigation efforts.