Indistinguishable from Malware
It looks like a package, right?
Uh, there’s no files in the payload. Let’s expand it.
pkgutil --expand ~/Downloads/zoomusInstaller.pkg ~/Downloads/zoomusInstaller-expanded.pkg
Ok, there’s a pkg inside that... what the what?
The Distribution file has to say something about this... ok, it’ll allow install to a user’s home folder, and runs this pm_install_check(), which normally maps to system requirement-type stuff.
Wait a minute. Oh no they didn’t.
That’s system.run, charging ahead and running the preinstall script in the Scripts folder (next to zm.zip and a copy of the browser plugin?) without waiting for us to confirm installation?
It’s checking admin membership...?
And here it’s unzipping the 11MB zm.zip file inside the pkgs Scripts folder, essentially installing the app DURING THE INSTALL CHECK, based on logic of where it has write access to, and then gives the app 775, (and copies the browser plugin into /Library, making one in ~/Library if need be, while it’s at it,) just ‘cause.
As if that wasn’t bad enough, (installing files before you’ve explicitly approved it doing so,) after messing about with PlistBuddy to try and remove older versions of itself from the Dock (hello, 2009!)...
I mean, this is beyond:
It uses APPLESCRIPT to have INSTALLER prompt the user about adding to the Dock! After which it kills it (thrice, because y’know - Do it nice, do it thrice). So you’d believe that installer actually delivered a payload successfully. Sneaky and craptacular, what an aroma!
👏🏻