Fake Mac Zoom installer bypasses Gatekeeper to install infostealer, Jamf discovers

Malicious Installer Discovered

Cybersecurity company Jamf has uncovered a deceptive Mac installer for the videoconferencing application Zoom. This malicious software, identified as CloudSyncD, employs a method to circumvent Apple's Gatekeeper security feature, which is designed to prevent unauthorized applications from running on macOS.

Gatekeeper Bypass Mechanism

Typically, macOS blocks unnotarized applications. CloudSyncD, however, presents a disk image that mimics a standard installer but includes a background image with explicit instructions. These instructions guide users through the process of manually overriding Gatekeeper by navigating to System Settings, Privacy & Security, and selecting 'Open Anyway', followed by entering their administrator password. This social engineering tactic makes the bypass seem like a normal part of the installation process.

Infostealer Functionality

Upon successful installation, CloudSyncD not only installs the legitimate Zoom application but also deploys an infostealer. This malicious component is designed to capture user-entered data and transmit it to an attacker's server. The exfiltration of data can occur as frequently as every eight seconds, indicating a persistent and rapid data theft capability.

Security Implications and User Advice

The discovery of CloudSyncD highlights the ongoing threat of sophisticated malware targeting macOS users. The method of bypassing Gatekeeper by manipulating user interaction represents a notable security concern. Users are strongly advised to download and install applications exclusively from the official Mac App Store or directly from the websites of trusted developers to mitigate such risks.