Fake Zoom installer drops CloudSyncD backdoor on macOS with root privileges
Jamf Threat Labs says a new macOS backdoor, CloudSyncD, poses as a Zoom installer, tricks users into entering their password and uses it with sudo to run a persistent implant as root.