Loading story…
Researchers reported that the macOS adware family OSX.Pirrit used fake installers posing as Adobe Flash Player to trick users into granting administrative access, then downloaded additional components from remote infrastructure. One analyzed .pkg sample was a script-only installer with almost no embedded payload; its postinstall script retrieved an archive from c.firstinstallmac[.]club, unpacked it in /var/tmp, executed the downloaded binary, and deleted the artifacts afterward. The installer also collected host details including the macOS version and hardware UUID, and added a special URL parameter for systems running macOS 10.12.
The campaign was described as a more advanced Pirrit variant capable of obtaining root privileges, persisting on infected Macs, monitoring user activity, and hijacking browsers to serve ads. Researchers said the malware had infected tens of thousands of Macs and in some cases used AppleScript to inject advertisements directly into browsers, complicating removal compared with older proxy-based methods. The script-only packaging approach was also noted in WizardUpdate, suggesting operators used lightweight installers to evade static detection and swap delivered malware on demand.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
The installer analysis concluded that script-only packaging had been observed in both Pirrit and WizardUpdate adware families, enabling operators to fetch executable content at install time and potentially evade static detection or swap payloads on demand.
Analysis of a Pirrit-associated macOS PKG sample showed it masqueraded as Adobe Flash Player while containing no meaningful embedded payload. Instead, its postinstall script collected the host macOS version and hardware UUID, downloaded a remote archive from c.firstinstallmac[.]club, executed the retrieved binary from /var/tmp, and then deleted the artifacts.
TargetingEdge sent cease-and-desist letters seeking to deter publication of Amit Serper's research linking the company to OSX.Pirrit. Cybereason proceeded with publication despite the legal threats, while the company denied any connection to the malware.
Cybereason published research on a more advanced OSX.Pirrit variant that could obtain root privileges, persist on infected Macs, spy on user activity, and inject ads into browsers via AppleScript. Serper said the malware remained highly active and had infected tens of thousands of Macs.
Amit Serper said he had tracked OSX.Pirrit and its variants for over a year, establishing a long-running investigation into the macOS adware family.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple macOS malware campaigns used BitTorrent and pirated software installers to deliver ransomware or ransomware-themed payloads, showing that Apple systems were repeatedly targeted through fake cracks and trojanized apps. **KeRanger** was distributed through an infected Transmission BitTorrent client installer, while **Patcher** (`OSX/Filecoder.E`) posed as cracks for software such as Microsoft Office for Mac and Adobe Premiere Pro. Patcher encrypted files in user folders and mounted external or network volumes by placing them into password-protected ZIP archives, deleted the originals, and dropped `README!.txt` ransom notes demanding **0.25 BTC** via a hardcoded wallet and email address. Later analysis of **EvilQuest/ThiefQuest** found that its ransomware behavior was largely a cover for more destructive activity. The malware was spread through trojanized pirated macOS applications, established persistence, opened a reverse shell, checked for security tools, and downloaded Python-based payloads to steal files from `/Users`, including documents, certificates, source code, databases, and cryptocurrency wallets. Researchers also found major flaws in some of these campaigns: Patcher had no practical way to return encryption keys to victims even if they paid, and EvilQuest used suspiciously static ransom infrastructure, reinforcing that pirated software channels remained a recurring infection vector and that victims faced both irreversible data loss and data theft.
Aug 14, 2026
Threat actors are abusing interest in AI developer tools by impersonating installers and setup guides to trick users into executing malware. Fake installation-guide pages for Anthropic’s **Claude Code** were promoted via **Google Ads** to rank highly for searches like “Claude Code install/CLI,” leading Windows and macOS users to run copy-pasted commands in an **InstallFix** campaign (a variant of **ClickFix**) that ultimately deployed **Amatera** (an **ACR Stealer**-based MaaS infostealer). Push Security reported the malware steals browser-stored credentials, cookies, session tokens, and system information, and the infrastructure used legitimate hosting/CDN services (e.g., *Squarespace*, *Cloudflare Pages*, *Tencent EdgeOne*) to reduce suspicion. In a related AI-tool impersonation theme, JFrog identified a malicious **npm** package, `@openclaw-ai/openclawai`, posing as an **OpenClaw** installer that targets macOS users to steal credentials and establish persistent remote access. The package uses a `postinstall` hook to reinstall itself globally and registers a CLI via the `bin` field pointing to `scripts/setup.js`, which presents a fake installer UI and then prompts for the user’s system password via a bogus Keychain/iCloud authorization flow. The malware (self-identified as **GhostLoader**) was reported to collect browser data, crypto wallets, SSH keys, Apple Keychain databases, and iMessage history, while also deploying a **RAT** with **SOCKS5 proxy** capability and “live browser session cloning,” indicating a blend of credential theft and long-term access objectives.
Aug 21, 2026
SentinelLabs reported that a large **AdLoad** malware campaign targeting macOS operated without detection by Apple’s built-in **XProtect** protections. The activity involved widespread distribution of AdLoad variants, a long-running adware and malware family known for abusing fake installers and trojanized applications to gain a foothold on Mac systems. The report said the campaign’s scale and ability to bypass native macOS defenses highlighted a significant visibility gap for organizations relying solely on Apple’s default malware controls. The findings underscored the risk that undetected Mac malware can persist in enterprise environments, exposing users to unwanted advertising, browser manipulation, data collection, and follow-on compromise.
Jul 12, 2026