CLOUDSYNCDCloudSyncD

Persistent macOS backdoor first observed by Jamf Threat Labs in mid-September 2026, distributed as a fake Zoom installer disk image. The dropper extracts a universal Mach-O payload at runtime, phishes the user's password through a fake activation prompt and uses it locally to run the payload with sudo, after which it runs as a daemon named CloudSyncD, profiles the host and polls its command-and-control server to download and run further payloads; later builds use Cloudflare-fronted domains disguised as jQuery requests. Elastic Security Labs reported it in October 2026 as the macOS payload of the REF8801 fake Web3 accelerator operation. No threat actor has been named.