Cybersecurity researchers have found new artifacts related to an Apple macOS malware known as ZuRu, which is thought to propagate by way of trojanized variations of official software program.
SentinelOne, in a brand new report shared with The Hacker Information, mentioned the malware has been noticed masquerading because the cross‑platform SSH consumer and server‑administration instrument Termius in late Could 2025.
“ZuRu malware continues to prey on macOS customers looking for official enterprise instruments, adapting its loader and C2 strategies to backdoor its targets,” researchers Phil Stokes and Dinesh Devadoss mentioned.
ZuRu was first documented in September 2021 by a person on Chinese language question-and-answer web site Zhihu as a part of a malicious marketing campaign that hijacked searches for iTerm2, a official macOS Terminal app, to direct customers to pretend websites that tricked unsuspecting customers into downloading the malware.
Then in January 2024, Jamf Risk Labs mentioned it found a chunk of malware distributed by way of pirated macOS apps that shared similarities with ZuRu. A number of the different in style software program that has been trojanized to ship the malware embody Microsoft’s Distant Desktop for Mac, together with SecureCRT and Navicat.
The truth that ZuRu primarily depends on sponsored net searches for distribution signifies the menace actors behind the malware are extra opportunistic than focused of their assaults, whereas additionally making certain that solely these on the lookout for distant connections and database administration are compromised.
Just like the samples detailed by Jamf, the newly found ZuRu artifacts make use of a modified model of the open-source post-exploitation toolkit often called Khepri to allow attackers to realize distant management of contaminated hosts.
“The malware is delivered by way of a .dmg disk picture and comprises a hacked model of the real Termius.app,” the researchers mentioned. “Because the software bundle contained in the disk picture has been modified, the attackers have changed the developer’s code signature with their very own advert hoc signature so as to move macOS code signing guidelines.”
The altered app packs in two additional executables inside Termius Helper.app, a loader named “.localized” that is designed to obtain and launch a Khepri command-and-control (C2) beacon from an exterior server (“obtain.termius[.]data”) and “.Termius Helper1,” which is a renamed model of the particular Termius Helper app.
“Whereas the usage of Khepri was seen in earlier variations of ZuRu, this implies of trojanizing a official software varies from the menace actor’s earlier approach,” the researchers defined.
“In older variations of ZuRu, the malware authors modified the principle bundle’s executable by including an extra load command referencing an exterior .dylib, with the dynamic library functioning because the loader for the Khepri backdoor and persistence modules.”
In addition to downloading the Khepri beacon, the loader is designed to arrange persistence on the host and checks if the malware is already current at a pre-defined path within the system and employs(“/tmp/.fseventsd”) and in that case, compares the MD5 hash worth of the payload towards the one which’s hosted on the server.
A brand new model is subsequently downloaded if the hash values do not match. It is believed that the characteristic doubtless serves as an replace mechanism to fetch new variations of the malware as they develop into out there. However SentinelOne additionally theorized it could possibly be a means to make sure that the payload has not been corrupted or modified after it was dropped.
The modified Khepri instrument is a feature-packed C2 implant that permits file switch, system reconnaissance, course of execution and management, and command execution with output seize. The C2 server used to speak with the beacon is “ctl01.termius[.]enjoyable.”
“The newest variant of macOS.ZuRu continues the menace actor’s sample of trojanizing official macOS purposes utilized by builders and IT professionals,” the researchers mentioned.
“The shift in approach from Dylib injection to trojanizing an embedded helper software is probably going an try to avoid sure sorts of detection logic. Even so, the actor’s continued use of sure TTPs – from selection of goal purposes and area identify patterns to the reuse of file names, persistence and beaconing strategies – recommend these are providing continued success in environments missing adequate endpoint safety.”
