Researchers say CloudSyncD has moved from the lab to live deployment, riding in on a fake Zoom installer.