New OSX.Pirrit Adware Component Injects JS via AppleScript

Researchers dissected an obfuscated Python-compiled OSX.Pirrit adware component that uses AppleScript to inject JavaScript into Chrome, though modern macOS/Chrome now block the attack.

Objective-See, working with MacPaw researcher Paul Taykalo, analyzed a previously undetected (0/56 on VirusTotal) sample believed to be a new component of the long-running OSX.Pirrit (VSearch) Mac adware family. The sample was distributed as compiled Python 2.7 bytecode, further obfuscated with zlib compression and base64 encoding, and was decompiled and manually deobfuscated to recover its logic. The persistent component reads platform UUID and macOS version, contacts a remote server via urllib2, and stores/retrieves configuration through an XOR-encoded and base64-encoded shelve file.

A related, less-obfuscated sample found in a folder named search.amp allowed fuller analysis. It persisted via a launch item running a bash script that invoked a Python script, which decoded an XOR/base64-encoded payload into an AppleScript. This AppleScript checked active Chrome tabs and, if not already infected, injected a JavaScript tag pointing to a remote CDN-hosted script (ij1.min.js), which in turn attempted to load further JavaScript from a secondary domain to enable ad injection or browser hijacking for revenue generation. The final payload server returned empty responses at analysis time, limiting full visibility into the ultimate objective, though the pattern matches typical adware ad-injection/monetization behavior.

The researchers note that current versions of macOS (Mojave+) and Google Chrome block AppleScript-driven JavaScript injection by default, requiring explicit user approval, which neutralizes this specific attack chain on updated systems. The findings underscore the value of keeping OS and browser software current and illustrate common adware techniques: bytecode compilation, layered obfuscation (zlib/base64/XOR), and living-off-the-land use of macOS's osascript utility to execute injected code purely in memory.

Source reporting: https://objective-see.org/blog/blog_0x3F.html