New OSX.Pirrit Adware Component Injects JS via AppleScript

Researchers dissected an obfuscated Python-compiled OSX.Pirrit adware component that uses AppleScript to inject JavaScript into Chrome, though modern macOS/Chrome now block the attack.

Objective-See, working with MacPaw researcher Paul Taykalo, analyzed a previously undetected (0/56 on VirusTotal) sample believed to be a new component of the long-running OSX.Pirrit (VSearch) Mac adware family. The sample was distributed as compiled Python 2.7 bytecode, further obfuscated with zlib compression and base64 encoding, and was decompiled and manually deobfuscated to recover its logic. The persistent component reads platform UUID and macOS version, contacts a remote server via urllib2, and stores/retrieves configuration through an XOR-encoded and base64-encoded shelve file.

A related, less-obfuscated sample found in a folder named search.amp allowed fuller analysis. It persisted via a launch item running a bash script that invoked a Python script, which decoded an XOR/base64-encoded payload into an AppleScript. This AppleScript checked active Chrome tabs and, if not already infected, injected a JavaScript tag pointing to a remote CDN-hosted script (ij1.min.js), which in turn attempted to load further JavaScript from a secondary domain to enable ad injection or browser hijacking for revenue generation. The final payload server returned empty responses at analysis time, limiting full visibility into the ultimate objective, though the pattern matches typical adware ad-injection/monetization behavior.

The researchers note that current versions of macOS (Mojave+) and Google Chrome block AppleScript-driven JavaScript injection by default, requiring explicit user approval, which neutralizes this specific attack chain on updated systems. The findings underscore the value of keeping OS and browser software current and illustrate common adware techniques: bytecode compilation, layered obfuscation (zlib/base64/XOR), and living-off-the-land use of macOS's osascript utility to execute injected code purely in memory.

title: 'Layered Obfuscation: Base64 and XOR Decoding in Python Scripts'
description: Detects Python process execution with command-line arguments or script
  content indicating base64 and XOR decoding chains. Matches the obfuscation pattern
  used by OSX.Pirrit and related adware to hide malicious payloads in transit and
  at rest.
tags:
- attack.defense-evasion
- attack.t1027
- attack.t1140
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /python
    CommandLine|contains|all:
    - base64
    - decode
  selection_xor:
    Image|endswith: /python
    CommandLine|contains|all:
    - xor
    - encode
  filter_legitimate:
    CommandLine|contains:
    - openssl
    - pip
  condition: (selection or selection_xor) and not filter_legitimate
falsepositives:
- Legitimate Python data processing pipelines using base64 encoding
- System administration scripts that decode credentials or configuration data
level: medium
id: 80c2dfd3-dcf3-500a-abf7-89e4e852d4db
status: experimental
author: Vorant

Source reporting: https://objective-see.org/blog/blog_0x3F.html