Jamf Threat Labs reported CloudSyncD, a new macOS backdoor that spreads through a fake Zoom installer and beacons to its server every 8 to 16 seconds. First caught as a VirusTotal sample that looked unfinished, it now appears in builds that connect to live infrastructure in what Jamf calls an active campaign.
Perspective Coverage
5 publishers
- Builder
- Builder 25%
- Operator
- Operator 70%
- Investor
- Investor 5%
Reality
- Evidence70
- Adoption15
- Hype gap+15
- Incentives
- Insufficient
- Confidence68
Jamf Threat Labs says the Rust macOS stealer pastes itself in via Terminal, fakes an Installer password prompt, mutes the speakers, then hands the operator a headless clone of your logged-in profile.
Perspective Coverage
5 publishers
- Builder
- Builder 30%
- Operator
- Operator 65%
- Investor
- Investor 5%
Reality
- Evidence68
- Adoption
- Insufficient
- Hype gap+10
- Incentives40
- Confidence70
Microsoft Defender Experts tied 30+ domains to a macOS stealer by matching execution, staging and upload behaviour. The count is incidental; the method is the part worth copying.
Perspective Coverage
3 publishers
- Builder
- Builder 28%
- Operator
- Operator 67%
- Investor
- Investor 5%
Reality
- Evidence68
- Adoption
- Insufficient
- Hype gap+10
- Incentives45
- Confidence70
Jamf Threat Labs found a PamStealer build that completes a server key exchange before its macOS payload decrypts, so captured samples cannot be recovered offline. It also layers four persistence methods and a Swift stealer that harvests keychains and credentials from 13 browsers.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap+5
- Incentives
- Insufficient
- Confidence62
Cato Networks says a sponsored ad outranked OpenAI's own page, sending macOS developers to a Google Sites portal whose ClickFix content lives on infrastructure Google never hosted.
Perspective Coverage
3 publishers
- Builder
- Builder 34%
- Operator
- Operator 58%
- Investor
- Investor 8%
Reality
- Evidence60
- Adoption
- Insufficient
- Hype gap+10
- Incentives35
- Confidence65
Kaspersky says a new MacSync variant hides its payload commands in public iCloud calendar events and downloads the next stage from iCloud. Both the instructions and the download ride trusted Apple domains, past defenses that block known-bad hosts.
Reality
- Evidence70
- Adoption
- Insufficient
- Hype gap0
- Incentives
- Insufficient
- Confidence68
SentinelOne has documented North Korea's Jade Sleet inside a small Indian IT services provider, using Rust backdoors built for Apple Silicon and a Terraform lock file that points developers at a fake HashiCorp registry.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+15
- Incentives40
- Confidence55
Unit 42 followed the copy-paste instructions on Aug. 5, 2026, and watched one Zsh command install AMOS twice over and package a lab Mac's wallet folders and cloud credentials into a single zip.
Reality
- Evidence70
- Adoption30
- Hype gap−10
- Incentives40
- Confidence62
buildOne report1 publisher Huntress and BleepingComputer describe sponsored ads that land on a real Claude Artifact page. The download link and the pasted curl command both reach elsewhere, so the trusted hostname never serves the payload.
Reality
- Evidence45
- Adoption35
- Hype gap+15
- Incentives55
- Confidence45
Cato says a sponsored result for "codex macos download" leads to a Google Sites clone whose Terminal command strips quarantine flags and stages an AMOS-linked payload.
Reality
- Evidence58
- Adoption34
- Hype gap+12
- Incentives66
- Confidence57