New Variant of ZuRu Malware Targets Developers through Compromised Termius macOS Application
July 10, 2025
Endpoint Security / Vulnerability
Cybersecurity experts have identified a new variant of the ZuRu malware affecting Apple macOS systems, known for propagating through trojanized versions of reputable software. In a recent report shared with The Hacker News, SentinelOne revealed that this malware has been posing as the popular cross-platform SSH client and server management tool, Termius, since late May 2025. Researchers Phil Stokes and Dinesh Devadoss noted, “ZuRu malware continues to exploit macOS users in search of legitimate business tools, evolving its loader and command-and-control techniques to backdoor its targets.” Initially documented in September 2021 on the Chinese question-and-answer platform Zhihu, ZuRu was part of a malicious campaign that redirected search results for the legitimate Terminal app iTerm2 to fraudulent websites designed to lure users into downloading the malware. In January 2024, Jamf Threat Labs also reported the distribution of this malware via pirated macOS applications.
Endpoint Security / Vulnerability
New Variant of ZuRu Malware Targets Developers through Compromised Termius for macOS Published on July 10, 2025 In a concerning development for macOS users, cybersecurity experts have identified a new variant of the ZuRu malware. This malware is specifically targeting developers by masquerading as the widely-used SSH client and server…
New Variant of ZuRu Malware Targets Developers through Compromised Termius macOS Application
July 10, 2025
Endpoint Security / Vulnerability
Cybersecurity experts have identified a new variant of the ZuRu malware affecting Apple macOS systems, known for propagating through trojanized versions of reputable software. In a recent report shared with The Hacker News, SentinelOne revealed that this malware has been posing as the popular cross-platform SSH client and server management tool, Termius, since late May 2025. Researchers Phil Stokes and Dinesh Devadoss noted, “ZuRu malware continues to exploit macOS users in search of legitimate business tools, evolving its loader and command-and-control techniques to backdoor its targets.” Initially documented in September 2021 on the Chinese question-and-answer platform Zhihu, ZuRu was part of a malicious campaign that redirected search results for the legitimate Terminal app iTerm2 to fraudulent websites designed to lure users into downloading the malware. In January 2024, Jamf Threat Labs also reported the distribution of this malware via pirated macOS applications.
