Cybersecurity researchers have found new artifacts related to an Apple macOS malware known as ZuRu, which is thought to propagate through trojanized variations of legit software program.
SentinelOne, in a brand new report shared with The Hacker Information, stated the malware has been noticed masquerading because the cross‑platform SSH consumer and server‑administration software Termius in late Could 2025.
“ZuRu malware continues to prey on macOS customers searching for legit enterprise instruments, adapting its loader and C2 strategies to backdoor its targets,” researchers Phil Stokes and Dinesh Devadoss stated.
ZuRu was first documented in September 2021 by a person on Chinese language question-and-answer web site Zhihu as a part of a malicious marketing campaign that hijacked searches for iTerm2, a legit macOS Terminal app, to direct customers to pretend websites that tricked unsuspecting customers into downloading the malware.
Then in January 2024, Jamf Menace Labs stated it found a bit of malware distributed through pirated macOS apps that shared similarities with ZuRu. A number of the different widespread software program that has been trojanized to ship the malware embody Microsoft’s Distant Desktop for Mac, together with SecureCRT and Navicat.
The truth that ZuRu primarily depends on sponsored net searches for distribution signifies the menace actors behind the malware are extra opportunistic than focused of their assaults, whereas additionally making certain that solely these in search of distant connections and database administration are compromised.
Just like the samples detailed by Jamf, the newly found ZuRu artifacts make use of a modified model of the open-source post-exploitation toolkit referred to as Khepri to allow attackers to achieve distant management of contaminated hosts.
“The malware is delivered through a .dmg disk picture and comprises a hacked model of the real Termius.app,” the researchers stated. “For the reason that utility bundle contained in the disk picture has been modified, the attackers have changed the developer’s code signature with their very own advert hoc signature so as to cross macOS code signing guidelines.”
The altered app packs in two further executables inside Termius Helper.app, a loader named “.localized” that is designed to obtain and launch a Khepri command-and-control (C2) beacon from an exterior server (“obtain.termius[.]data”) and “.Termius Helper1,” which is a renamed model of the particular Termius Helper app.
“Whereas the usage of Khepri was seen in earlier variations of ZuRu, this implies of trojanizing a legit utility varies from the menace actor’s earlier method,” the researchers defined.
“In older variations of ZuRu, the malware authors modified the primary bundle’s executable by including a further load command referencing an exterior .dylib, with the dynamic library functioning because the loader for the Khepri backdoor and persistence modules.”
In addition to downloading the Khepri beacon, the loader is designed to arrange persistence on the host and checks if the malware is already current at a pre-defined path within the system and employs(“/tmp/.fseventsd”) and in that case, compares the MD5 hash worth of the payload towards the one which’s hosted on the server.
A brand new model is subsequently downloaded if the hash values do not match. It is believed that the function probably serves as an replace mechanism to fetch new variations of the malware as they turn into obtainable. However SentinelOne additionally theorized it might be a means to make sure that the payload has not been corrupted or modified after it was dropped.
The modified Khepri software is a feature-packed C2 implant that enables file switch, system reconnaissance, course of execution and management, and command execution with output seize. The C2 server used to speak with the beacon is “ctl01.termius[.]enjoyable.”
“The newest variant of macOS.ZuRu continues the menace actor’s sample of trojanizing legit macOS purposes utilized by builders and IT professionals,” the researchers stated.
“The shift in method from Dylib injection to trojanizing an embedded helper utility is probably going an try to bypass sure sorts of detection logic. Even so, the actor’s continued use of sure TTPs – from alternative of goal purposes and area identify patterns to the reuse of file names, persistence and beaconing strategies – counsel these are providing continued success in environments missing adequate endpoint safety.”
