Pirrit adware ships native M1 binary

14 February 2021 routine threat

Researchers found GoSearch22, a Pirrit adware variant, compiled with native Apple Silicon (arm64) code, likely the first M1-native macOS malware.

Objective-See researcher Patrick Wardle, while porting his own tools to run natively on Apple's M1 chips, hunted VirusTotal for malicious universal Mach-O binaries containing arm64 code and discovered GoSearch22, a macOS application signed with a (since revoked) Apple developer ID. Analysis of the app bundle confirmed it is a variant of the well-known Pirrit adware family, bundling a Safari extension that injects ads and can collect browsing data, IPs, search queries, and geolocation. The sample includes anti-analysis logic such as ptrace-based anti-debugging (PT_DENY_ATTACH) and multiple checks for virtual-machine artifacts to hinder sandboxed analysis.

The significance of the find is less about Pirrit's adware behavior—which is well documented—and more about the precedent it sets: malware authors are now compiling multi-architecture binaries to gain native compatibility with Apple Silicon, following the same porting incentives as legitimate developers. Wardle's testing showed that splitting the binary into separate x86_64 and arm64 versions and rescanning them on VirusTotal produced roughly 15% lower detection rates for the arm64 slice, with some AV engines failing to flag the arm64 code at all or labeling it inconsistently versus the x86_64 equivalent.

The sample was originally submitted to VirusTotal in December 2020 via an Objective-See tool (likely KnockKnock) after a user's persistence mechanism triggered a flag. There is no indication of large-scale active distribution beyond typical adware bundling/installation vectors, and the finding is primarily a research observation about detection-engineering gaps for Apple Silicon rather than an active large-scale campaign.

Mentioned in this report

Malware GoSearch22Pirrit

Detection guidance

macOS Process Attempting ptrace Anti-Debugging

ATT&CK T1622

Process calling ptrace with PT_DENY_ATTACH to prevent debugger attachment, typical of adware and malware evasion. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: macOS Process Attempting ptrace Anti-Debugging
description: Detects use of ptrace() with PT_DENY_ATTACH flag to prevent debugger
  attachment. Common in adware and malware attempting to evade dynamic analysis.
tags:
- attack.defense-evasion
- attack.t1622
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    CommandLine|contains: PT_DENY_ATTACH
  condition: selection
falsepositives:
- Legitimate security research tools and debuggers
- Some commercial software protection mechanisms
level: medium
id: 2f2664c1-6bc3-53f3-b199-cb461f49f5a2
status: experimental
author: Vorant

macOS Application Bundle Loading Unsigned or Suspicious Extension

ATT&CK T1176

macOS application bundle containing a Safari extension binary, indicative of browser hijacking adware. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: macOS Application Bundle Loading Unsigned or Suspicious Extension
description: Detects macOS application bundles containing embedded Safari extensions,
  typical of adware that injects ads and collects browsing data.
tags:
- attack.persistence
- attack.t1176
logsource:
  category: file_event
  product: macos
detection:
  selection:
    TargetFilename|contains:
    - .app/Contents/
    TargetFilename|endswith:
    - .safariextz
    - .bundle/Contents/MacOS
    Image|endswith:
    - /Safari
    - /Safari.app/Contents/MacOS/Safari
  condition: selection
falsepositives:
- Legitimate Safari extension installation from App Store
- User-authorized extension updates
level: medium
id: 61d90a59-5297-5842-8bcf-5fa122741a6d
status: experimental
author: Vorant

macOS Process Checking for Virtual Machine Artifacts

ATT&CK T1497

Process executing commands to detect virtual machine or sandbox environment, typical of malware attempting evasion. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: macOS Process Checking for Virtual Machine Artifacts
description: Detects processes checking for common VM/sandbox indicators such as Parallels,
  VMware, or kernel debug flags, typical of evasion-aware malware.
tags:
- attack.defense-evasion
- attack.t1497
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    CommandLine|contains|all:
    - sysctl
    - vm.
    CommandLine|contains:
    - hw.model
    - hw.machine
    - kern.bootargs
  selection_hwinfo:
    CommandLine|contains:
    - SPHardwareDataType
  filter_admin:
    User: root
  condition: (selection or selection_hwinfo) and not filter_admin
falsepositives:
- System diagnostic tools and IT support scripts
- Hardware inventory collection by MDM solutions
level: medium
id: 70cb78e2-c07b-5e84-99fc-d0316ba41db7
status: experimental
author: Vorant

1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x62.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free