Researchers found a fake Zoom installer for macOS that tricks users into bypassing built-in security checks and entering their Mac login password. The password is used locally to run a second-stage backdoor with elevated privileges, enabling remote commands and additional payload delivery. Jamf did not confirm real-world infections but observed samples configured to talk to live command-and-control servers.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You download a Zoom update for macOS… and it asks for your Mac login password. Totally normal, right? This fake Zoom installer arrives as a disk image, then walks you through bypassing Gatekeeper in System Settings. Next, it pops up a slick password box and quietly uses your password to launch a hidden backdoor. Here’s the trap: the password never leaves your Mac. It’s validated locally, then used with sudo-level access to run a backdoor that talks over encrypted C2 and surveys your system, while you think Zoom just installed. If any installer tells you to bypass Gatekeeper or asks for your Mac password unexpectedly, stop. Don’t enter it, contact IT and only use Zoom from our approved sources.
Researchers found a malicious macOS app disguised as a Zoom installer. It walks users through bypassing macOS security prompts, then repeatedly asks for the user’s password to ‘continue installation’ until the correct password is entered. The stolen password is hidden inside a fake settings file…
Microsoft reports an active campaign where attackers set up counterfeit software download pages that mimic well-known brands and trick users into installing malware. Victims visit a look-alike vendor site, click “Download now,” then run a bundled installer that drops persistent malware and connects…
Researchers found a real macOS malware campaign that uses a fake GitHub download page to convince users to paste a command into Terminal and enter their Mac password. The malware then steals credentials, cookies, and files, and can even turn the victim’s Chromium browser into a remotely controlled…
Researchers found macOS users being tricked into installing a fake Zoom app that actually installs a persistent backdoor called CloudSyncD. The installer guides the victim through a normal-looking setup and prompts for the user’s password so it can run with elevated privileges and stay on the Mac…
Researchers describe AmnesiaStealer, a macOS infostealer spread via a convincing fake GitHub download page that tricks users into pasting a Terminal command. After installation, it uses an “Installer”-style password prompt to capture the Mac login password, steal browser and keychain data, and can…
Researchers warn about a new macOS infostealer called “CrashStealer” that pretends to be Apple’s Crash Reporter. It uses a legitimate-looking installer and a fake macOS-style password prompt to trick users into unlocking Keychain, then steals credentials and crypto wallet data.
