The installation of the app appears legitimate and mounts as a disk image named Zoom laid out to look like any ordinary Mac installer with the application icon on the left and an alias to the Applications folder on the right. However, it also includes user instructions to bypass macOS’ Gatekeeper security,
If CloudSyncD is installed, it monitors and records data that the user has entered. It can send reports to the attackers as frequently as every 8 seconds. CloudSyncD can also be used be the attacker to remotely execute commands.
How to protect yourself from malware
The easiest way to protect yourself from malware is to avoid downloading software from unfamiliar repositories. Apple has vetted software in the Mac App Store, and it is the safest way to get apps. If you prefer not to patronize the Mac App Store, then buy software directly from the developer and their website. If you insist on using cracked software, you will always risk malware exposure.
Never open links in emails or texts you receive from unknown and unexpected sources. If you get a message that looks like it is from an entity that you do business with, check the sender’s email address and inspect the URL carefully. If you see a link or button, you can Control-click it, select Copy Link Address, and then paste it into a text editor to see the actual URL and check it.
Macworld has several guides to help, including a guide on whether or not you need antivirus software, a list of Mac viruses, malware, and trojans, and a comparison of Mac security software.
