New OSX.Pirrit Adware Component Injects JS via AppleScript

PublishedThe source gives no date · added 2 August 2026 Vorant ratingroutine threat

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Researchers dissected an obfuscated Python-compiled OSX.Pirrit adware component that uses AppleScript to inject JavaScript into Chrome, though modern macOS/Chrome now block the attack.

Sourceobjective-see.org — open the original

What to check

Applies to: Whether this concerns you is not assessed; the names the report mentions are listed below.
Date: The source gives no publication date; the date shown is the day Vorant added the brief.

Objective-See, working with MacPaw researcher Paul Taykalo, analyzed a previously undetected (0/56 on VirusTotal) sample believed to be a new component of the long-running OSX.Pirrit (VSearch) Mac adware family. The sample was distributed as compiled Python 2.7 bytecode, further obfuscated with zlib compression and base64 encoding, and was decompiled and manually deobfuscated to recover its logic. The persistent component reads platform UUID and macOS version, contacts a remote server via urllib2, and stores/retrieves configuration through an XOR-encoded and base64-encoded shelve file.

A related, less-obfuscated sample found in a folder named search.amp allowed fuller analysis. It persisted via a launch item running a bash script that invoked a Python script, which decoded an XOR/base64-encoded payload into an AppleScript. This AppleScript checked active Chrome tabs and, if not already infected, injected a JavaScript tag pointing to a remote CDN-hosted script (ij1.min.js), which in turn attempted to load further JavaScript from a secondary domain to enable ad injection or browser hijacking for revenue generation. The final payload server returned empty responses at analysis time, limiting full visibility into the ultimate objective, though the pattern matches typical adware ad-injection/monetization behavior.

The researchers note that current versions of macOS (Mojave+) and Google Chrome block AppleScript-driven JavaScript injection by default, requiring explicit user approval, which neutralizes this specific attack chain on updated systems. The findings underscore the value of keeping OS and browser software current and illustrate common adware techniques: bytecode compilation, layered obfuscation (zlib/base64/XOR), and living-off-the-land use of macOS's osascript utility to execute injected code purely in memory.

Mentioned in this report

Malware OSX.Pirrit

Detection guidance

Layered Obfuscation: Base64 and XOR Decoding in Python Scripts

ATT&CK T1027 · status experimental · needs macos process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects Python script execution performing sequential base64 and XOR decoding operations typical of Pirrit-style adware payload deobfuscation chains. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: 'Layered Obfuscation: Base64 and XOR Decoding in Python Scripts'
description: Detects Python process execution with command-line arguments or script
  content indicating base64 and XOR decoding chains. Matches the obfuscation pattern
  used by OSX.Pirrit and related adware to hide malicious payloads in transit and
  at rest.
tags:
- attack.stealth
- attack.t1027
- attack.t1140
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /python
    CommandLine|contains|all:
    - base64
    - decode
  selection_xor:
    Image|endswith: /python
    CommandLine|contains|all:
    - xor
    - encode
  filter_legitimate:
    CommandLine|contains:
    - openssl
    - pip
  condition: (selection or selection_xor) and not filter_legitimate
falsepositives:
- Legitimate Python data processing pipelines using base64 encoding
- System administration scripts that decode credentials or configuration data
level: medium
id: 80c2dfd3-dcf3-500a-abf7-89e4e852d4db
status: experimental
author: Vorant

1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x3F.html

Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account What it costs