New ZuRu Malware Variant Targets macOS via Termius SSH Exploit

A sophisticated new variant of the macOS.ZuRu malware, originally identified in 2021, has resurfaced, employing a trojanized version of the Termius SSH client to deploy a modified Khepri command-and-control (C2) beacon.

This iteration, detected in late May 2025, demonstrates advanced evasion techniques aimed at developers and IT professionals, facilitating persistent remote access while circumventing macOS security mechanisms.

SentinelOne’s recent analysis highlights how threat actors have refined their approach, shifting from dynamic library injections to direct application trojanization, thereby evading detection systems that monitor for anomalous library loads.

Evolving Tactics in Persistent macOS Threats

The malware’s delivery vector involves a compromised .dmg disk image containing a bloated Termius.app bundle, expanded from the legitimate 225MB size to 248MB by embedding two malicious executables within the Termius Helper.app sub-bundle.

Here, the authentic Termius Helper binary is renamed to .Termius Helper1, supplanted by a 25MB malicious Mach-O executable that masquerades as the legitimate helper. Upon execution, this imposter launches the original .

Termius Helper1 to maintain normal application functionality, while simultaneously invoking a loader named .localized.

This loader extracts and deploys a Khepri C2 beacon, persisting it at /tmp/.fseventsd, ensuring covert operation.

The Khepri beacon, derived from an open-source post-exploitation framework, has been customized to operate in either skip mode or as a background daemon, featuring an accelerated 5-second heartbeat interval half the default 10 seconds for rapid C2 communication over port 53.

It employs a decoy domain like www.baidu[.]com to obfuscate traffic, routing actual commands to servers following ZuRu’s established naming patterns, such as ctl01.macnavicat[.]com.

To bypass macOS Gatekeeper protections, the trojanized application replaces the developer’s legitimate code signature with an ad hoc signature, exploiting implicit trust in signed binaries.

The .localized loader further enhances resilience through MD5 hash-based integrity verification, automatically downloading updated payloads if mismatches occur, thereby adapting to potential disruptions.

This update mechanism, combined with Khepri’s extensive capabilities including file exfiltration, system enumeration, process injection, and command execution with output redirection poses severe risks to compromised environments, enabling long-term espionage or lateral movement within IT and development networks.

ZuRu’s focus on backend tools like Termius, SecureCRT, and Navicat suggests a deliberate strategy to infiltrate professional workflows, often via pirated or poisoned downloads, underscoring the perils of unverified software sources.

Implications for macOS Security

According to the Report, PolySwarm analysts classify macOS.ZuRu as an evolving threat, with its latest variant marking a tactical pivot toward more stealthy persistence methods.

By leveraging trojanized applications rather than library injections, attackers mitigate risks from endpoint detection and response (EDR) tools that flag dynamic loading anomalies.

The malware’s reliance on modified open-source tools like Khepri illustrates the growing sophistication of macOS-targeted campaigns, blending commodity frameworks with custom evasion logic.

Organizations are advised to enforce strict software integrity checks, including hash verification and source authentication, while monitoring for unusual network behaviors such as rapid heartbeats over non-standard ports.

As ZuRu continues to adapt, proactive threat hunting and user education on safe downloading practices remain critical defenses against this persistent macOS adversary.

Indicators of Compromise (IOCs)

Indicator Type	SHA-256 Hash	PolySwarm Link
Malicious Sample	8ac593fbe69ae93de505003eff446424d4fd165cda6f85c8c27e8e1cb352b06e	View Scan
Malicious Sample	42605f1d22f8d38f0be494f36d377bf71592ae54583e6e78641a63ec3021cbeb	View Scan

Get Free Ultimate SOC Requirements Checklist Before you build, buy, or switch your SOC for 2025 - Download Now