CloudSyncD macOS malware infrastructure
The CloudSyncD macOS malware strain is actively utilizing malicious URLs to facilitate botnet command-and-control communications and payload delivery, often masquerading as legitimate jQuery library requests.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 5, 13:32 UTC
- Detection
- 5 IOCs
- Source quality
- A1Likely
CloudSyncD (osx.cloudsyncd) is a macOS malware strain identified by ThreatFox as utilizing specific network infrastructure for command-and-control (C2) and payload delivery. Observed traffic often features URL patterns mimicking legitimate jQuery library requests to blend into network traffic. The source confirms the infrastructure is currently active as of November 2026.
Recommendation
- Block the identified malicious URLs at the corporate proxy and DNS egress points.
- Hunt for outbound HTTPS requests to the identified IPs or domains, particularly those containing long, URI-encoded paths mimicking library file names.
- Leverage the provided URLs to update network perimeter security controls.
Immediate actions
Block identified CloudSyncD infrastructure in perimeter security controls.
Threat Hunt
Identify outbound connections from macOS assets to non-standard ports (e.g., 8080) hosting URLs containing "jquery" or complex path structures.
Data: Network proxy logs, DNS logs
Enrichment needed
- IP/Domain reputation (CTI) Determine scope of infrastructure beyond the initial 5 indicators.
Mitigations
Implement egress filtering for known malicious indicators.
CloudSyncD C2 traffic
Gaps
- Missing host-level telemetry for CloudSyncD persistence or execution on macOS.
Indicators of compromise
5
url
| Type | Value |
|---|---|
| url | https://187.77.134.200:8080/index.html/v1/enterprise/administration/assessment/scheduler/combine/jquery-3.3.2.min.js |
| url | https://187.124.23.99:8080/index.html/v5/enterprise/infrastructure/decryption/editor/categorize/jquery-3.3.2.min.js |
| url | https://dodiihome.com/macos/jquery.js |
| url | https://187.124.82.117:8080/index.html/v2.3/enterprise/security/alerting/service/execute/jquery-3.3.2.min.js |
| url | https://ecl.zs-catch.com:443/index.html/rc1/enterprise/manufacturing/serialization/parser/query/jquery-3.3.2.min.js |