ZuRu malware has been identified as targeting macOS users by masquerading as authentic software like Termius. It first emerged in September 2021, initially leveraging search engine hijacking to deceive users into downloading malicious versions of legitimate applications. The opportunistic nature of its distribution method, primarily through sponsored searches, focuses on those seeking remote management tools. Newly discovered variants utilize a modified toolkit called Khepri to facilitate remote access, demonstrating the malware's evolving techniques for compromise.
ZuRu malware continues to prey on macOS users seeking legitimate business tools, adapting its loader and C2 techniques to backdoor its targets.
The malware is delivered via a .dmg disk image and contains a hacked version of the genuine Termius.app.
Collection
[
|
...
]