TF-MAL-osx.zuru
📛 Threat Title
Malware family: ZuRu
Description
ThreatFox malware family `osx.zuru`. Printable name: ZuRu.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
osx.zuru
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/osx.zuru
IOC database
- Type
- domain
- Value
osx.zuru- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-osx.zuru
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/osx.zuru
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:advisory.eventussecurity.com
EXECUTIVE SUMMARY EXECUTIVE SUMMARY macOS. ZuRu is a persistent backdoor campaign initially uncovered through poisoned search results that led users to download trojanized versions of popular macOS utilities. These included tools frequently used by developers and administrators such as iTerm2, SecureCRT, Navicat, and Remote Desktop clients. The malware was distributed through modified ...
-
web:bitnewsbot.com
The malware uses a modified open-source toolkit called Khepri for remote access and control. Attackers distribute ZuRu primarily through trojanized apps found via sponsored web searches. Recent changes show the malware now uses new methods to bypass security on macOS systems.
-
web:cybersecuritynews.com
A new ZuRu macOS malware variant spreads via trojanized Termius SSH app, targeting developers with advanced infection techniques.
-
web:dailysecurityreview.com
Hackers are embedding ZuRu malware into legitimate Mac developer apps like Termius, compromising systems with persistent backdoors and targeting environments lacking strong endpoint protection.
-
web:thehackernews.com
Cybersecurity researchers have discovered new artifacts associated with an Apple macOS malware called ZuRu , which is known to propagate via trojanized versions of legitimate software. SentinelOne, in a new report shared with The Hacker News, said the malware has been observed masquerading as the cross‑platform SSH client and server‑management tool Termius in late May 2025. " ZuRu malware ...
-
web:www.newsready.com
How ZuRu Bypasses Apple's Security Measures Apple's code-signing system is supposed to guarantee that only trusted software runs on Mac machines. Unfortunately, ZuRu's operators have found a way around this safeguard by replacing legitimate developer signatures with ad hoc ones, effectively tricking the operating system into accepting the malware -laden apps. This signature spoofing ...
-
web:www.pcquest.com
Security researchers at SentinelOne discovered a malicious malware variant, called Zuru , that is infecting macOS systems via modified applications. Unlike traditional malware , Zuru is spreading stealthily by using tools that are used by Apple developers and IT administrators, so this is a big increase in macOS-focused threats.
-
web:www.pcrisk.com
What kind of malware is ZuRu ? ZuRu is a piece of malicious software targeting macOS (Mac Operating System). It is classed as a backdoor - a type of malware that opens "backdoors" into systems for further infections, and some are capable of infiltrating additional malicious content. The multiple versions of ZuRu have been spread through various campaigns that primarily relied on legitimate ...
-
web:www.securitymagazine.com
Below, security leaders share insights on this malware as well as risk mitigation strategies. Security Leaders Weigh In Ms. Nivedita Murthy, Senior Staff Consultant at Black Duck: MacOS users should be cautious of the evolving ZuRu trojan, which is being embedded in legitimate software. To protect themselves, users should adhere to software security best practices, such as downloading ...
-
web:www.sentinelone.com
ZuRu malware continues to prey on macOS users seeking legitimate business tools, adapting its loader and C2 techniques to backdoor its targets.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.