CloudSyncD: a two-stage macOS backdoor that hides a phished password in zero-width Unicode

Jamf Threat Labs uncovers CloudSyncD, a fake Zoom installer disguised as a legitimate application that uses a phished login password to launch an embedded backdoor while concealing the credential inside a decoy configuration file.