The app installation looks legitimate and mounts as a disk image called Zoom designed to look like any normal Mac installer with the app icon on the left and an alias of the Applications folder on the right. However, it also includes user instructions for bypassing macOS Gatekeeper security.
If CloudSyncD is installed, it monitors and records the data that the user has entered. It can send reports to attackers as frequently as 8 seconds. CloudSyncD can also be used as an attacker to execute commands remotely.
How to protect yourself from malware
The easiest way to protect yourself from malware is to avoid downloading software from unknown repositories. Apple has vetted the software in the Mac App Store and it is the safest way to get apps. If you prefer not to frequent the Mac App Store, purchase software directly from the developer and their website. If you insist on using cracked software, you will always run the risk of exposing yourself to malware.
Never open links in emails or text messages you receive from unknown and unexpected sources. If you receive a message that appears to come from an entity you do business with, verify the sender’s email address and inspect the URL carefully. If you see a link or button, you can Control-click it, select Copy link addressand then paste it into a text editor to see the actual URL and verify it.
Macworld has several help guides, including a guide on whether or not you need antivirus software, a list of Mac viruses, malware, and Trojans, and a comparison of Mac security software.
