GoKawiilJamf finds fake Zoom Mac installer that tricks users into bypassing Gatekeeper
Security firm Jamf identified malware dubbed CloudSyncD distributed as a fake Zoom installer for Mac. The disk image mimics a normal installer but includes a background image with step-by-step instructions guiding victims through System Settings to manually override Apple's Gatekeeper protection. Once approved, it installs the real Zoom app alongside an infostealer that sends captured user data to attackers' servers as often as every eight seconds.
GoKawiil's interpretation of the reporting above, not reported fact.
The technique shifts the burden of bypassing macOS security from the malware itself to the user, exploiting trust and familiarity with installer prompts rather than technical exploits. This suggests attackers are adapting to Apple's notarization defenses by engineering social compliance instead of code-level workarounds, which could make similar scams harder to block through traditional security scanning.
- CloudSyncD malware poses as a Zoom installer but visually instructs users on bypassing Gatekeeper.
- Once installed, it steals user data and transmits it to attackers every eight seconds.
- Users are advised to only install Mac apps from the App Store or trusted developer sites.
Malwarebytes Premium for Mac — Since fake installers like this CloudSyncD Zoom dropper rely on tricking you into bypassing Gatekeeper, having real-time malware scanning on your Mac adds another layer of defense. Malwarebytes Premium for Mac actively scans downloaded disk images and installers, helping catch infostealers before they get a chance to run. It's a smart complement to Apple's built-in protections, especially as attackers get craftier about social-engineering their way past security prompts.
See Malwarebytes Premium for Mac on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: 9to5mac.com — Ben Lovejoy, 2026-10-01
Published there as: “This fake Mac Zoom installer has a sneaky way to bypass Gatekeeper”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.