macOS.ZuRu
macOS.ZuRu is a macOS backdoor malware family distributed via poisoned Baidu search results and trojanized versions of legitimate applications used by developers and IT professionals. Recent SentinelOne reporting describes a re-emergent variant concealed in a trojanized Termius SSH client delivered as a malicious .dmg disk image. In this campaign, the fake Termius app included a modified Termius Helper component embedding a loader named .localized, which fetched a Khepri-based command-and-control beacon from download.termius[.]info and wrote it to /tmp/.fseventsd. The beacon was reported to communicate with ctl01.termius[.]fun. Compared with older ZuRu samples that relied on dylib injection, the newer variant embeds the loader directly in the application bundle. Reported capabilities include remote control, file transfer, system reconnaissance, process control, and command execution through the open-source Khepri toolkit. The malware also checks for existing installations, compares MD5 hashes, and updates itself if needed. Persistence was established via a malicious LaunchDaemon using the fake label com.apple.xssooxxagent, executing a copy of .localized every hour from /Users/Shared/com.apple.xssooxxagent. Supporting content also notes that macOS.ZuRu campaigns targeted Web3 and cryptocurrency-related platforms and were attributed to China.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
IOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
macOS.ZuRu is a macOS backdoor that uses a modified Khepri C2 framework, distributed via a trojanized Termius SSH client.
macOS.ZuRu is a backdoor malware targeting macOS systems, distributed via trojanized legitimate applications (such as Termius SSH client). It uses a modified Khepri C2 beacon for remote control, enabling attackers to transfer files, perform system reconnaissance, control processes, and execute commands. It features persistence mechanisms and self-update capabilities.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.