[cloudsyncd]

October 13, 2026

• "Apex Accelerator", a fake Web3 VC programme, lured crypto founders with free AI credits and security audits, then shipped npm packages @apexacc/cli and @apexacc/audit that fetch and run attacker commands. macOS victims get the CloudSyncD backdoor; Windows victims get an infostealer that targets browser data, wallets and AI client configs for Claude, Cursor and Windsurf (Elastic Security Labs). · Supply Chain

in Malware That Lives Off the Victim's AI Tooling

October 2, 2026

• Jamf documented CloudSyncD, a two-stage macOS backdoor distributed through a fake Zoom installer. The DMG directs victims to bypass Gatekeeper and presents a fraudulent authorization prompt. The malware validates the entered password and conceals it using invisible Unicode characters rather than immediately transmitting it, complicating casual inspection of its artifacts. Jamf Threat Labs · Threat Activity & Supply Chain

in OpenAI Disrupts a Coordinated Model-Reasoning Extraction Campaign