CloudSyncD: a two-stage macOS backdoor that hides a phished password in zero-width Unicode
By Jamf Threat Labs
Excerpt
Jamf Threat Labs uncovers CloudSyncD, a fake Zoom installer disguised as a legitimate application that uses a phished login password to launch an embedded backdoor while concealing the credential inside a decoy configuration file.
September 30 2026 by
Jamf Threat Labs
By: Thijs Xhaflaire
Introduction
We first…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by jamf.com on jamf.com.
More from jamf.com1
jamf.com · Web page · Added 25 Sep
Contagious Interview steps outside the developer workflow
Jamf Threat Labs uncovers fake macOS installers tied to the same infrastructure behind past Git hook and VS Code task file attacks. September 3 2026 by Jamf Threat Labs By Allen Golbig Introduction Jamf Threat Labs identified a cluster of macOS disk images…
On the same topics
Microsoft · Web page · Published 29 Sep
Star Blizzard refines phishing and malware delivery with the RedFlick technique
Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malware delivery technique that…
zerobec.com · Web page · Published 11 Jun
Introducing LX RAT: ITR Phishing Targets Finance and Tech
ZeroBEC researchers uncovered a prolonged phishing and malware campaign that uses Indian Income Tax Return (ITR) refund lures to deliver a multi-stage AutoIt infection chain. The campaign targeted financial and technology organizations and successfully evaded…
AhnLab · Web page · Published 2 Aug
Analysis of a Phishing Email Attack Case by the Larva-24009 Threat Actor
The Larva-24009 threat actor has been active since at least 2023, carrying out phishing email attacks targeting users both in Korea and globally to install malware. ASEC (AhnLab SEcurity intelligence Center (ASEC) has previously disclosed attack cases by this…
Trend Micro · Web page · Published 29 Jun
TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry
Attackers are targeting employees of Booking.com partner companies in Japan, using phishing emails that impersonate guest complaints and review requests to trick hotel staff into executing malicious files. Multiple email delivery methods were observed,…