New ZuRu macOS Malware Spreads via Trojanized Business Apps

According to a report from SentinelOne, researchers observed ZuRu using a fake version of Termius. Attackers delivered the malware via a .dmg disk image, which included a tampered application bundle signed with the threat actor’s own code signature. This particular method allows ZuRu to bypass macOS code signing restrictions.

The report notes that ZuRu employs a modified version of Khepri, an open-source toolkit that lets attackers remotely control infected systems. The malware installs extra executables, including a loader designed to fetch commands from an external server. “ZuRu malware continues to prey on macOS users seeking legitimate business tools, adapting its loader and C2 techniques to backdoor its targets,” researchers Phil Stokes and Dinesh Devadoss stated.

First documented in September 2021, ZuRu was known to hijack searches related to popular Mac tools like iTerm2. It directed users to fake websites, leading them to download malware-infected files. In January 2024, Jamf Threat Labs connected ZuRu to pirated apps, including Microsoft’s Remote Desktop for Mac, SecureCRT, and Navicat, all distributed with hidden malware.

The recent variant changes how it hides within apps. Instead of modifying the main executable with a malicious add-on, attackers now embed the threat inside a helper application. This adjustment appears aimed at dodging traditional malware detection. The loader checks for the presence of existing malware, verifies its integrity, and downloads updates if a mismatch is found.