Skip to content
Today
Sign in

Gatekeeper

macOS security feature that verifies app code-signing and quarantines unverified downloads, blocking untrusted software from running by default.

Sign in to follow

Known aliases

  • App Translocation
  • macOS Gatekeeper

Current stories

security5 publishersConfirmed

Fake Zoom installer talks macOS users past Gatekeeper to drop CloudSyncD backdoor

Jamf Threat Labs reported CloudSyncD, a new macOS backdoor that spreads through a fake Zoom installer and beacons to its server every 8 to 16 seconds. First caught as a VirusTotal sample that looked unfinished, it now appears in builds that connect to live infrastructure in what Jamf calls an active campaign.

Publishers:9to5mac.cominfosecurity-magazine.comscworld.comsecurityaffairs.comsecurityweek.com

Perspective Coverage

5 publishers
Builder
Builder 25%
Operator
Operator 70%
Investor
Investor 5%

Reality

Evidence70
Adoption15
Hype gap+15
Incentives
Insufficient
Confidence68
build1 publisherOne report

Bundling Node left 24 dylib references pointing at /opt/homebrew

The installer launched fine on the build machine and quit in about a second on a Mac that had never run Homebrew. Getting it to start took 26 dylibs copied into the bundle, every path rewritten to @loader_path, and an ad hoc re-sign.

Publishers:dev.to

Reality

Evidence55
Adoption8
Hype gap+12
Incentives45
Confidence55