Loading story…
A fake iTerm2 website, iterm2.net, impersonated the legitimate iterm2.com page and distributed a trojanized macOS installer through a malicious DMG hosted on related infrastructure. Researchers found the altered app was signed with an Apple Distribution certificate tied to “Jun Bi (AQPZ6F3ASY)” but was not notarized; Apple later revoked the certificate. The malware added a malicious dynamic library dependency, causing libcrypto.2.dylib to load automatically and contact attacker-controlled servers after execution.
The implanted library sent host identifiers including the Mac serial number to remote infrastructure, executed server-supplied shell commands, and fetched second-stage payloads including a Python script, g.py, and a Mach-O binary named GoogleUpdate linked to Cobalt Strike. The Python component, associated with the ZuRu malware family, harvested extensive data such as shell histories, SSH files, keychain contents, application data, and directory listings for exfiltration. Investigators also identified similarly trojanized macOS applications, including SecureCRT, Microsoft Remote Desktop, and Navicat, indicating a broader campaign targeting Mac users through cloned software download sites.
Get the infrastructure and lures behind it.
7 events from the most recent confirmed update back to the earliest known activity.
Patrick Wardle published an analysis of the macOS malware campaign dubbed OSX.ZuRu, detailing the fake iTerm2 site, malicious dylib injection, and second-stage payload delivery.
Security researcher Zhi (@CodeColorist) publicly reported the campaign and referenced an earlier Zhihu write-up describing the trojanized macOS software distribution activity.
The domain kaidingle.com was registered and later served multiple trojanized DMG packages, including iTerm, SecureCRT, and Navicat installers tied to the ZuRu campaign.
VirusTotal recorded multiple URLs on the campaign's second-stage server at 47.75.123.111 over this period, indicating active hosting of follow-on payloads and tools.
Trend Micro reported that a fake iTerm2 site distributed a trojanized app that loaded a malicious libcrypto.2.dylib, fetched g.py and GoogleUpdate, and stole extensive user and system data. The company also identified related trojanized macOS apps and infrastructure suggesting a broader campaign targeting Mac users.
Objective-See reported iTerm2.net appeared offline as of September 15, 2021, while Trend Micro later noted the same domain remained active as of that date, reflecting differing observations around the campaign infrastructure.
Apple revoked the 'Apple Distribution: Jun Bi (AQPZ6F3ASY)' certificate that had been used to sign the trojanized iTerm application.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 46 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported multiple social-engineering campaigns targeting macOS users with **fake CAPTCHA** and **ClickFix** lures that trick victims into copying and pasting malicious commands into Terminal, shifting execution to the user and bypassing traditional app-download protections. One campaign delivered **Atomic macOS Stealer (AMOS)** through trojanized cracked applications and malicious Terminal instructions, stealing credentials, browser data, cryptocurrency wallets, Telegram data, VPN profiles, keychain contents, Apple Notes, and files from common user folders before compressing and exfiltrating them over HTTP/HTTPS. Trend Micro separately documented multistage fake CAPTCHA attacks that also led to infostealers and remote-access trojans, underscoring the broader use of human-verification themes to launch malware chains. A separate July 2026 macOS campaign used a fake **TrustKey** verification page on Cloudflare Pages, a Cloudflare Worker, and an AppleScript-based loader to install a persistent backdoor named **`bmodule`** via LaunchAgent persistence. The malware dynamically resolved live command-and-control infrastructure from a **Polygon** smart contract using an **EtherHiding** technique, then fingerprinted hosts, phished macOS login passwords, and fetched tasks to deploy AMOS variants, an interactive shell, or an **XMRig** cryptominer. Apple said **macOS Sequoia** has updated runtime protections, while incident reporting shows Terminal-based social-engineering chains remain effective because they rely on users to execute the malicious commands directly.
Aug 28, 2026
Researchers documented several malware campaigns that used fake software and trojanized packages to deliver credential theft and remote-access payloads. On Windows, a fake *Resident Evil 9* mod from GitHub triggered a `curl | cmd` chain that deployed hidden batch, JavaScript, portable Node.js, portable Python, and an in-memory Go payload with browser theft, wallet targeting, hVNC-style control, webcam-related code, and exfiltration via Wormhole/B2 and Gofile; a separate fake AI video player installer led through Python bytecode, shellcode, and protected .NET loaders to **PureRAT**, which persisted through the `Run` key and communicated over authenticated WebSockets with `agent.sm-veo.com`. Another Windows campaign, dubbed **Operation TURB00**, used a Go loader and decoy console program to launch **Vidar** in memory, steal browser and application data, and install persistence through `agt.dll` and the `CadenceOptimizer` service running under `svchost` as `LocalSystem`. On macOS, analysts reversed a fully undetected **Atomic macOS Stealer (AMOS)** sample distributed as a signed DMG, bypassed its anti-VM checks, and recovered an AppleScript payload that stole browser data, wallet files, Telegram Desktop data, documents, and system information before exfiltrating to `95.164.53.3/contact`. In the software supply chain, a malicious PyPI package, `nhmpy 2.4.7`, masqueraded as NumPy while using a `.pth` file and an obfuscated JavaScript payload executed through Bun to harvest developer, cloud, CI/CD, registry, SSH, wallet, messaging, VPN, and AI-assistant secrets; it then spread using stolen GitHub tokens and malicious GitHub Actions workflows. Separately, a public Windows local privilege escalation exploit named **REDSUN** showed how attackers could turn standard-user access into `NT AUTHORITY\SYSTEM` by abusing a TOCTOU flaw involving NTFS and the Cloud Files API, creating a potential post-compromise path for malware already running on a host.
Jul 12, 2026
Threat actors are abusing **software-brand impersonation** to trick users into installing malware from fake distribution points, relying on social engineering rather than software exploits. Datadog reported an active campaign using **fake GitHub repositories** that impersonate established technology companies and leverage the **ClickFix** technique—prompting victims to copy/paste commands into *Terminal* (macOS) or *PowerShell/Run* (Windows)—to install infostealers. Datadog observed iterative updates to the *MacSync* lure and a new macOS infostealer variant self-branded as **“SHub Stealer v2.0”**, with expanded capabilities including **persistence** and **remote access**, alongside anti-analysis/evasion features intended to hinder detection and track infection outcomes; Datadog also assessed signs the actor is expanding toward **Windows infostealer** functionality. Separately, Malwarebytes documented a lookalike **7-Zip** download site (`7zip[.]com`, impersonating the legitimate `7-zip.org`) distributing a **trojanized installer** that installs a working 7-Zip File Manager while silently converting infected Windows systems into **residential proxy nodes**. The installer was **Authenticode-signed** with a certificate issued to **Jozeal Network Technology Co., Limited** (now revoked), and it dropped additional components—`Uphero.exe` (service manager/update loader), `hero.exe` (Go-compiled proxy payload), and `hero.dll`—under `C:\Windows\SysWOW64\hero\`; one reported case surfaced via Microsoft Defender detection `Trojan:Win32/Malgent!MSR` after the system had been exposed for an extended period. Together, the reporting highlights a sustained risk from **trusted-brand impersonation** and “looks legitimate” installers/repositories that deliver credential theft or monetize endpoints via proxyware.
Jul 2, 2026