New macOS.ZuRu Backdoor Variant Leverages Khepri C2 Beacon

EXECUTIVE SUMMARY

macOS.ZuRu is a persistent backdoor campaign initially uncovered through poisoned search results that led users to download trojanized versions of popular macOS utilities. These included tools frequently used by developers and administrators such as iTerm2, SecureCRT, Navicat, and Remote Desktop clients. The malware was distributed through modified application bundles that appeared legitimate but were embedded with malicious components. These applications targeted users who relied on backend tools for remote access, indicating a specific focus on infrastructure-oriented environments. In more recent variants, the campaign has evolved to include the Termius SSH management tool, which was similarly trojanized and spread via a disk image file containing altered binaries. The malware authors replaced the official code signature with an ad hoc version to bypass macOS code signing checks.[emaillocker id="1283"]

The trojanized Termius application contains a modified helper component that acts as a loader and persistence installer. On execution, the malicious binary .localized is launched, which downloads a secondary payload from a remote server and stores it at a temporary system path. It modifies the system by installing a LaunchDaemon that ensures the loader executes hourly, maintaining persistence. The malware uses deprecated system APIs to request elevated privileges; a tactic aimed at avoiding modern security scrutiny. It implements a lockfile mechanism to ensure only one instance runs at a time and verifies the integrity of its downloaded payload by comparing MD5 hashes retrieved from the control server. If mismatched, the payload is replaced, enabling updates and continuity. The downloaded payload is decrypted using a custom routine based on a multi-step XOR operation with a string key, replacing the simpler encryption method used in previous versions. The binary also contains leftover code from earlier iterations, pointing to reused or hastily updated components. The final stage beacon, based on a modified Khepri C2, offers a full suite of surveillance and execution features while disguising its traffic through port 53 and decoy domain names.

The latest evolution of macOS.ZuRu shows a notable shift in infection techniques, now embedding malicious components into helper apps instead of relying on traditional binary injections. This likely aims to bypass behavioral detections and maintain stealth on systems used by technical professionals. While the methods have changed, many elements remain consistent, including the choice of remote access utilities, reused domain structures, and persistence tactics. The malware’s reliance on a modified open-source beacon, capable of file transfer, command execution, and system reconnaissance, underscores its versatility and adaptability. The use of DNS-associated ports, fast beacon intervals, and hardcoded update logic indicates a well-prepared setup to ensure long-term presence on compromised systems. Although the malware continues to adapt its delivery methods, its core structure and tactics show patterns that can be monitored and flagged. Organizations without advanced endpoint protection are urged to review the technical behaviors and indicators tied to this campaign to mitigate risks associated with this persistent macOS backdoor.

THREAT PROFILE:

MBC MAPPING:

REFERENCES:

The following reports contain further technical details:

• https://thehackernews.com/2025/07/new-macos-malware-zuru-targeting.html
• https://www.sentinelone.com/blog/macos-zuru-resurfaces-modified-khepri-c2-hides-inside-doctored-termius-app/