How to remove ZuRu malware from Mac

What kind of malware is ZuRu?

ZuRu is a piece of malicious software targeting macOS (Mac Operating System). It is classed as a backdoor – a type of malware that opens "backdoors" into systems for further infections, and some are capable of infiltrating additional malicious content.

The multiple versions of ZuRu have been spread through various campaigns that primarily relied on legitimate apps that were trojanized and search engine poisoning techniques.

ZuRu malware overview

The initial variant of ZuRu was discovered in 2021; it and those that followed infiltrated systems as trojanized applications. The latest version was found in May 2025, it arrived onto systems within a trojanized Termius – a cross‑platform SSH (Secure Shell Protocol) client.

The following is an overview of the infection chain and capabilities of this newest ZuRu variant. The malware is compatible with macOS versions Sonoma 14.1 and later. This backdoor has a multi-stage infection chain. The modified Termius app is contained within a DMG file (Apple Disk Image). It also includes malicious binaries intended to further the infection. The trojanized program's signature is changed, and the one replacing it is designed to bypass the appropriate macOS security measures.

The infection progresses by establishing a loader, ensuring that the behavior of the altered app aligns with user expectations, and by downloading a Khepri C2 implant (Khepri is a database for Erlang and Elixir environments). This C2 beacon's abilities are: collecting relevant device and system data, transferring files, managing and running processes, as well as executing commands.

The second stage of ZuRu's infection chain is of note, as during it checks are made on the payload to verify whether it is present and matches all prerequisites. This feature could be utilized as an anti-tempering measure or update mechanism for the payload.

It is worth mentioning that malware capable of causing chain infections can theoretically infiltrate just about any type of malicious programs (e.g., trojans, ransomware, cryptominers, etc.) yet, in practice, it tends to work within certain limitations/specifications.

To summarize, the presence of software like ZuRu on devices can lead to system infections, severe privacy issues, financial losses, and identity theft.

Backdoor malware examples

We have written about thousands of malicious programs; NokNok, RShell, and macOS.Macma are merely a few of our latest articles on Mac backdoors. Software within this classification may cause a wide variety of infections – ranging from data stealers to file-encrypting ransomware.

However, regardless of how malware operates – its presence on a system threatens device and user safety. Therefore, all threats must be eliminated immediately upon detection.

How did ZuRu install on my computer?

As described in the article above, the newest variant of ZuRu infiltrated systems through a trojanized Termius app. This is consistent with previous versions of this backdoor, wherein other legitimate applications have also been modified in the proliferation efforts – including Microsoft Remote Desktop (Mac version), Navicat, and SecureCRT. The compromised apps were distributed through SEO poisoning of the Baidu search engine.

However, ZuRu could be added to other genuine programs or spread under the guise of such. Phishing and social engineering are standard in malware distribution.

Malware is primarily proliferated via drive-by (stealthy/deceptive) downloads, malvertising, pirated software/media, untrustworthy download channels (e.g., freeware and free file-hosting websites, P2P sharing networks, etc.), online scams, malicious attachments/links in spam emails and messages, illegal program activation tools ("cracks"), and fake updates.

Furthermore, some malicious programs can self-spread through local networks and removable storage devices (e.g., external hard drives, USB flash drives, etc.).

How to avoid installation of malware?

Caution is essential to ensuring safety for yourself and your devices. Therefore, download only from official and verified sources. Activate and update programs using functions/tools provided by legitimate developers, as those obtained from third-parties can contain malware.

Additionally, be vigilant when browsing since the Internet is full of deceptive and malicious content. Treat incoming emails and other messages with care; do not open attachments or links found in suspicious mail.

It is paramount to have a reputable antivirus installed and kept up-to-date. Security software must be used to run regular system scans and to remove detected threats. If your computer is already infected, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate infiltrated malware.

ZuRu containing trojanized Termius installer:

Trojanized Termius app containing ZuRu:

Instant automatic malware removal:

Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:

By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.

Quick menu:

• What is "ZuRu"?
• Remove PUA related files and folders from OSX.

Video showing how to remove adware and browser hijackers from a Mac computer:

Potentially unwanted applications removal:

Remove potentially unwanted applications from your "Applications" folder:

Click the Finder icon. In the Finder window, select "Applications". In the applications folder, look for "Termius", or other suspicious applications and drag them to the Trash. After removing the potentially unwanted application(s) that cause online ads, scan your Mac for any remaining unwanted components.

Frequently Asked Questions (FAQ)

My computer is infected with ZuRu malware, should I format my storage device to get rid of it?

Malware removal rarely necessitates formatting.

What are the biggest issues that ZuRu malware can cause?

The threats posed by an infection depend on the malware's functionalities and the attackers' goals. ZuRu is a backdoor, a type of software that prepares systems for further infection. Generally, the presence of such a program on a device can lead to system infections, serious privacy issues, financial losses, and identity theft.

What is the purpose of ZuRu malware?

Malware is mainly used to generate revenue. However, attackers can also use malicious software to amuse themselves, carry out personal vendettas, disrupt processes (e.g., websites, services, companies, etc.), engage in hacktivism, and launch politically/geopolitically motivated attacks.

How did ZuRu malware infiltrate my computer?

ZuRu has been proliferated via trojanized legitimate software and distributed using SEO poisoning. Other distribution methods are possible.

The most widely used malware proliferation techniques include: malvertising, spam mail, online scams, drive-by downloads, dubious download channels (e.g., freeware and third-party websites, Peer-to-Peer sharing networks, etc.), pirated content, illegal software activation ("cracking") tools, and fake updates. Some malicious programs can self-spread through local networks and removable storage devices.

Will Combo Cleaner protect me from malware?

Combo Cleaner is capable of detecting and removing almost all known malware infections. It must be stressed that performing a full system scan is crucial since high-end malicious programs usually hide deep within systems.