A macOS dropper has been found inside a disguised Zoom client. The malware is tracked as CloudSyncD and is designed to deliver a persistent and stealthy backdoor.
Researchers at Jamf first noticed this malware still in development in mid-September. Within days, other samples were found suggesting it has now progressed from testing and development to deployment.
The malware infection process is initiated by any of the standard social engineering methods designed to persuade or trick victims into downloading dangerous content. In this case it is malware hidden in malicious code disguised as a Zoom Mac installer. If the phish is successful, a malware dropper is delivered to the victim as a disk image that mounts as a volume named Zoom. This dropper contains the payload but must be activated by the victim – hence the disguise as a Zoom installer. The victim is guided through the activation thinking it will install Zoom, but it actually installs CloudSyncD.
The dropper “carries a complete universal Mach-O inside itself, roughly 756 KB in the development build, and extracts it at runtime. The same payload is also present on disk inside the application bundle, so the dropper has two sources for it,” say the researchers.
The payload is written to an anonymous file descriptor, and the dropper attempts to execute it. Execution will fail in most cases because of the MacOS System Integrity Protection. If so, the dropper writes the file temporarily to disk and executes it using sudo along with the user’s password collected during the activation process.
The result of successful activation is implementation of the CloudSyncD malware. Its configuration is stored encrypted in the binary and decrypted at runtime. It runs through a daemon named CloudSyncD. The malware first analyzed by the researchers had not reached deployment stage. The C2 address was on a private network, and verbose debug logging was left on.
Now, however, the researchers have seen several malware builds on two separate domains. The URI path is identical in both, masquerading as a jQuery script so a beacon resembles an ordinary JavaScript fetch. Both domains were registered in 2011 through the same registrar and sit behind Cloudflare, and neither carried any detections at the time of writing.