OSX.ZuRu trojanizes macOS apps via Baidu ads
A macOS trojan called OSX.ZuRu is spread through fake sponsored Baidu search results for iTerm2 and other apps, dropping a Cobalt Strike backdoor and stealing system data.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Researchers identified a malvertising campaign delivering OSX.ZuRu, a macOS backdoor distributed through cloned websites (e.g., iTerm2.net) promoted via sponsored Baidu search results. Victims searching for legitimate tools like iTerm2 were served malicious sponsored links leading to trojanized disk images signed with a now-revoked Apple developer certificate. The trojanized application appears functionally identical to the legitimate app but loads a malicious dylib (libcrypto.2.dylib) at launch via a hijacked LC_LOAD_DYLIB entry, which executes automatically through Objective-C's +load method.
Once triggered, the malware beacons to a remote server (apps.mzstatics.com) using the infected machine's serial number as a unique identifier, then downloads and executes two second-stage payloads from 47.75.123.111: a Python script (g.py) that surveys the system (OS version, keychain, bash history, installed apps) and exfiltrates the data, and a UPX-packed Mach-O binary (GoogleUpdate) that connects to 47.75.96.198, an IP flagged on VirusTotal as an active Cobalt Strike C2 server. This grants attackers a full post-exploitation foothold on compromised macOS systems.
The researcher who first identified the campaign noted the scale was 'massive,' with additional trojanized applications discovered beyond iTerm2, including SecureCRT, Navicat15 (Chinese version), and a Microsoft Remote Desktop client, suggesting a broader supply-chain-style trojanizing operation targeting macOS users, likely concentrated in Chinese-speaking regions given the use of Baidu and Chinese-language artifacts. Apple has since revoked the abused code-signing certificate, and Baidu has reportedly removed the malicious sponsored links, but additional trojanized samples may remain undetected as none of the analyzed files were flagged by antivirus engines on VirusTotal at time of writing.
Mentioned in this report
Detection guidance
1 detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Source reporting: https://objective-see.org/blog/blog_0x66.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs