VORANT. Threat Intelligence Sign in Get the full feed

OSX.ZuRu trojanizes macOS apps via Baidu ads

routine threat

A macOS trojan called OSX.ZuRu is spread through fake sponsored Baidu search results for iTerm2 and other apps, dropping a Cobalt Strike backdoor and stealing system data.

Researchers identified a malvertising campaign delivering OSX.ZuRu, a macOS backdoor distributed through cloned websites (e.g., iTerm2.net) promoted via sponsored Baidu search results. Victims searching for legitimate tools like iTerm2 were served malicious sponsored links leading to trojanized disk images signed with a now-revoked Apple developer certificate. The trojanized application appears functionally identical to the legitimate app but loads a malicious dylib (libcrypto.2.dylib) at launch via a hijacked LC_LOAD_DYLIB entry, which executes automatically through Objective-C's +load method.

Once triggered, the malware beacons to a remote server (apps.mzstatics.com) using the infected machine's serial number as a unique identifier, then downloads and executes two second-stage payloads from 47.75.123.111: a Python script (g.py) that surveys the system (OS version, keychain, bash history, installed apps) and exfiltrates the data, and a UPX-packed Mach-O binary (GoogleUpdate) that connects to 47.75.96.198, an IP flagged on VirusTotal as an active Cobalt Strike C2 server. This grants attackers a full post-exploitation foothold on compromised macOS systems.

The researcher who first identified the campaign noted the scale was 'massive,' with additional trojanized applications discovered beyond iTerm2, including SecureCRT, Navicat15 (Chinese version), and a Microsoft Remote Desktop client, suggesting a broader supply-chain-style trojanizing operation targeting macOS users, likely concentrated in Chinese-speaking regions given the use of Baidu and Chinese-language artifacts. Apple has since revoked the abused code-signing certificate, and Baidu has reportedly removed the malicious sponsored links, but additional trojanized samples may remain undetected as none of the analyzed files were flagged by antivirus engines on VirusTotal at time of writing.

Mentioned in this report

Malware Cobalt StrikeOSX.ZuRu

Detection guidance

Suspicious Dylib Load from Non-Standard Location by Signed Application

ATT&CK T1574.004

Detects legitimate-looking macOS applications loading dylibs from unexpected paths (e.g., /tmp, /var/tmp, user temp directories) or with mismatched code signatures, indicative of dylib hijacking. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Dylib Load from Non-Standard Location by Signed Application
description: Detects signed macOS applications (e.g., iTerm2, SecureCRT) loading dynamic
  libraries from unusual or temporary locations, or loading unsigned dylibs when the
  parent is code-signed. This captures dylib hijacking attempts where trojanized apps
  load malicious dylibs at launch.
tags:
- attack.persistence
- attack.defense-evasion
- attack.t1574.004
logsource:
  category: image_load
  product: macos
detection:
  selection_unsigned_dylib_load:
    Image|endswith:
    - .dylib
    SignatureStatus: unsigned
    ParentImage|endswith:
    - /iTerm.app/Contents/MacOS/iTerm
    - /SecureCRT.app/Contents/MacOS/SecureCRT
    - /Navicat.app/Contents/MacOS/Navicat
    - /Microsoft\ Remote\ Desktop.app/Contents/MacOS/Microsoft\ Remote\ Desktop
  selection_suspicious_dylib_path:
    Image|contains:
    - /tmp/
    - /var/tmp/
    - /var/folders/
    Image|endswith: .dylib
    ParentImage|endswith:
    - /iTerm.app/Contents/MacOS/iTerm
    - /SecureCRT.app/Contents/MacOS/SecureCRT
    - /Navicat.app/Contents/MacOS/Navicat
    - /Microsoft\ Remote\ Desktop.app/Contents/MacOS/Microsoft\ Remote\ Desktop
  filter_system_dylibs:
    Image|startswith:
    - /usr/lib/
    - /System/Library/
    - /opt/homebrew/
  condition: (selection_unsigned_dylib_load or selection_suspicious_dylib_path) and
    not filter_system_dylibs
falsepositives:
- Legitimate software development tools or build systems loading dylibs from temp
  directories during installation or updates
- macOS software updates or security patches that temporarily stage dylibs in non-standard
  locations
level: high
id: e37900a0-af40-5d11-a72a-be1b8d3488bb
status: experimental
author: Vorant

Download and Execution of Secondary Payload from Remote Server

ATT&CK T1105

Detects suspicious applications downloading and executing secondary payloads (Python scripts, UPX-packed binaries) from remote IP addresses, particularly those known to host C2 infrastructure. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Download and Execution of Secondary Payload from Remote Server
description: Detects processes downloading and subsequently executing second-stage
  payloads from remote servers. Captures the pattern of fetching Python scripts or
  packed binaries (g.py, GoogleUpdate-like files) from suspicious external IPs and
  then executing them, typical of multi-stage macOS backdoor deployment.
tags:
- attack.command-and-control
- attack.t1105
- attack.execution
logsource:
  category: process_creation
  product: macos
detection:
  selection_python_execution:
    Image|endswith:
    - /usr/bin/python
    - /usr/bin/python3
    CommandLine|contains:
    - /tmp/g.py
    - /var/tmp/g.py
    - /var/folders/
    ParentImage|contains:
    - curl
    - wget
    - /usr/bin/python
  selection_upx_binary:
    Image|endswith:
    - /GoogleUpdate
    - /tmp/GoogleUpdate
    - /var/tmp/GoogleUpdate
    SignatureStatus: unsigned
  filter_legitimate_updates:
    Image|contains:
    - /Applications/
    - /Library/
    SignatureStatus: valid
  condition: (selection_python_execution or selection_upx_binary) and not filter_legitimate_updates
falsepositives:
- Development environments or CI/CD pipelines that download and execute scripts during
  legitimate build/test processes
- Software update mechanisms that fetch and install signed secondary components
level: high
id: fbfb77f8-8cd6-5118-9949-02a1836eed34
status: experimental
author: Vorant

1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x66.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free