Cybersecurity company Jamf has discovered a fake Mac installer for the videoconferencing app Zoom that uses a sneaky way to bypass Apple’s Gatekeeper protection against malware.

The malware does actually install Zoom, but also an infostealer that captures data and sends it to the attacker’s server …

Normally, when you try to install a Mac app that Apple hasn’t notarized, macOS will refuse to open it. There is a workaround to allow you to do so, but it’s somewhat fiddly, and attackers have to find some way to persuade users to do it.

The criminals behind the malware Jamf has dubbed CloudSyncD have found a clever way to make this seem more normal to users. The app installer dropper includes a background image with instructions, as shown above.

CloudSyncD arrives as a disk image that mounts as a volume named Zoom, laid out to look like any ordinary Mac installer: an application icon on the left, an alias to Applications on the right. The difference is the background image, which carries a numbered Setup list telling the victim to open System Settings, go to Privacy & Security, scroll to the Security section, click Open Anyway, and enter their administrator password. Those are instructions to bypass Gatekeeper.

You kind of have to admire the creativity of this.

Once the malware is installed, it can record user-entered data and send it to the attackers as frequently as every eight seconds.

As always, you should only ever install Mac apps from the official Mac App Store or the websites of developers you trust.

• Dark Cherry charger & color-matched cable for iPhone 18 Pro
• Beats Woven USB-C cables
• iPhone 18 Pro and iPhone 18 Pro Max cases
• Certified refurbished Apple products 15% off at apple.com
• Discounted AirPods Pro 3
• Wireless CarPlay adapter
• 10-year AirTag battery case
• Logitech MX Master 4 for Mac

Image: 9to5Mac/Jamf/Siora Photography

FTC: We use income earning auto affiliate links. More.