Malware

OSX.Pirrit

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.002AppleScriptEvidence1

What's new in this version is that the adware uses macOS' native scripting language, AppleScript -- typically reserved for automation -- to inject ads directly into the browser, rather than a proxy server that can be easily removed.

Privilege Escalation

1 technique

T1548Abuse Elevation Control MechanismEvidence1

Like other software, the installer asks for the user's password to install, tricking the user into turning over root privileges to the installer.

Stealth

2 techniques

T1036MasqueradingEvidence1

The adware, dubbed OSX.Pirrit, is still highly active... poses as a legitimate installer, like a video player or document reader.

T1218System Binary Proxy ExecutionEvidence1

The files used to maintain the adware's persistence on the infected Mac tries to mask themselves as legitimate macOS functions to try to hide from the victim.

Collection

1 technique

T1185Browser Session HijackingEvidence1

The maker of a sneaky adware that hijacks a user's browser to serve ads is back with a new, more advanced version

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

Once it's hooked into the system, the installer uses a script to download further components from the adware's command and control server.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

objective seeNews

Mar 25, 2019

Mac Adware, à la Python

OSX.Pirrit is a persistent Mac adware family known for injecting advertisements and popups into user sessions, often via browser injection. It can take complete control of the infected machine, making removal difficult, and uses obfuscation and persistence mechanisms to evade detection. Recent variants use Python bytecode and AppleScript to inject JavaScript into Chrome, aiming to display ads and potentially redirect users for financial gain.

zdnet zero dayNews

Dec 13, 2017

Maker of sneaky Mac adware sends security researcher cease-and-desist letters | ZDNET

A macOS adware family that masquerades as legitimate installers, tricks users into granting root privileges, downloads additional components from C2 infrastructure, maintains persistence by disguising itself as legitimate macOS functions, injects ads directly into browsers via AppleScript, and spies on users' browsing activity.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

OSX.Pirrit

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.002AppleScriptEvidence1

Privilege Escalation

1 technique

T1548Abuse Elevation Control MechanismEvidence1

Like other software, the installer asks for the user's password to install, tricking the user into turning over root privileges to the installer.

Stealth

2 techniques

T1036MasqueradingEvidence1

The adware, dubbed OSX.Pirrit, is still highly active... poses as a legitimate installer, like a video player or document reader.

T1218System Binary Proxy ExecutionEvidence1

The files used to maintain the adware's persistence on the infected Mac tries to mask themselves as legitimate macOS functions to try to hide from the victim.

Collection

1 technique

T1185Browser Session HijackingEvidence1

The maker of a sneaky adware that hijacks a user's browser to serve ads is back with a new, more advanced version

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

Once it's hooked into the system, the installer uses a script to download further components from the adware's command and control server.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

objective seeNews

Mar 25, 2019

Mac Adware, à la Python

zdnet zero dayNews

Dec 13, 2017

Maker of sneaky Mac adware sends security researcher cease-and-desist letters | ZDNET

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.