- Published
- Source
- Security Affairs
- Filed under
- Malware & exploits
- Technique
- T1566 Phishing (opens in a new tab)
Jamf Threat Labs details CloudSyncD, a fake macOS Zoom installer that hides a phished password using invisible zero-width Unicode characters. Jamf Threat Labs found CloudSyncD while doing routine scanning on VirusTotal, buried inside a disguised Zoom client. They first spotted it on September 15, clearly still under construction, and within two days watched it move…
Keeping malware out
- Keep operating systems, browsers and plugins patched – most malware arrives through known holes.
- Block macros and scripts from the internet, and let only approved software run where you can.
- Watch endpoint alerts for new persistence: scheduled tasks, services and run keys.
More helpNCSC: mitigating malware and ransomware attacks (opens in a new tab)
Defender’s notebook
The attacker technique behind this story, in MITRE’s terms – and what to check in your own estate.
Phishing
Initial AccessWhat a defender checks
- Search mail flow for the sender, subject and links, and pull every copy from mailboxes.
- Check who clicked or replied, and what signed in afterwards.
- Block the sender and URLs, and tell staff what to look for.
Build the skillBlue Team Analyst · Email & Phishing Investigation
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
MyCyberWay training
Blue Team Analyst
Every story here started as an alert. Learn to triage them.
Our Blue Team Analyst programme prepares you for a first SOC role: 26 live classes in UK hours, an alert queue worked in Microsoft Sentinel, and a full SOC shift simulation at the end. No security experience needed to start.
- Triage and KQL in Microsoft Sentinel
- Identity, endpoint, email and network investigations
- A verifiable digital badge
Headlines and short summaries only, except where a public body publishes under an open licence. Every story links to its publisher, who owns it. MyCyberWay does not edit or endorse third-party reporting.
