Pirrit adware ships native M1 binary
Researchers found GoSearch22, a Pirrit adware variant, compiled with native Apple Silicon (arm64) code, likely the first M1-native macOS malware.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Objective-See researcher Patrick Wardle, while porting his own tools to run natively on Apple's M1 chips, hunted VirusTotal for malicious universal Mach-O binaries containing arm64 code and discovered GoSearch22, a macOS application signed with a (since revoked) Apple developer ID. Analysis of the app bundle confirmed it is a variant of the well-known Pirrit adware family, bundling a Safari extension that injects ads and can collect browsing data, IPs, search queries, and geolocation. The sample includes anti-analysis logic such as ptrace-based anti-debugging (PT_DENY_ATTACH) and multiple checks for virtual-machine artifacts to hinder sandboxed analysis.
The significance of the find is less about Pirrit's adware behavior—which is well documented—and more about the precedent it sets: malware authors are now compiling multi-architecture binaries to gain native compatibility with Apple Silicon, following the same porting incentives as legitimate developers. Wardle's testing showed that splitting the binary into separate x86_64 and arm64 versions and rescanning them on VirusTotal produced roughly 15% lower detection rates for the arm64 slice, with some AV engines failing to flag the arm64 code at all or labeling it inconsistently versus the x86_64 equivalent.
The sample was originally submitted to VirusTotal in December 2020 via an Objective-See tool (likely KnockKnock) after a user's persistence mechanism triggered a flag. There is no indication of large-scale active distribution beyond typical adware bundling/installation vectors, and the finding is primarily a research observation about detection-engineering gaps for Apple Silicon rather than an active large-scale campaign.
Mentioned in this report
Detection guidance
macOS Process Attempting ptrace Anti-Debugging
A behavioural hunt for the technique in general.
Process calling ptrace with PT_DENY_ATTACH to prevent debugger attachment, typical of adware and malware evasion. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: macOS Process Attempting ptrace Anti-Debugging
description: Detects use of ptrace() with PT_DENY_ATTACH flag to prevent debugger
attachment. Common in adware and malware attempting to evade dynamic analysis.
tags:
- attack.stealth
- attack.t1622
logsource:
category: process_creation
product: macos
detection:
selection:
CommandLine|contains: PT_DENY_ATTACH
condition: selection
falsepositives:
- Legitimate security research tools and debuggers
- Some commercial software protection mechanisms
level: medium
id: 2f2664c1-6bc3-53f3-b199-cb461f49f5a2
status: experimental
author: Vorant
macOS Application Bundle Loading Unsigned or Suspicious Extension
A behavioural hunt for the technique in general.
macOS application bundle containing a Safari extension binary, indicative of browser hijacking adware. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: macOS Application Bundle Loading Unsigned or Suspicious Extension
description: Detects macOS application bundles containing embedded Safari extensions,
typical of adware that injects ads and collects browsing data.
tags:
- attack.persistence
- attack.t1176
logsource:
category: file_event
product: macos
detection:
selection:
TargetFilename|contains:
- .app/Contents/
TargetFilename|endswith:
- .safariextz
- .bundle/Contents/MacOS
Image|endswith:
- /Safari
- /Safari.app/Contents/MacOS/Safari
condition: selection
falsepositives:
- Legitimate Safari extension installation from App Store
- User-authorized extension updates
level: medium
id: 61d90a59-5297-5842-8bcf-5fa122741a6d
status: experimental
author: Vorant
macOS Process Checking for Virtual Machine Artifacts
A behavioural hunt for the technique in general.
Process executing commands to detect virtual machine or sandbox environment, typical of malware attempting evasion. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: macOS Process Checking for Virtual Machine Artifacts
description: Detects processes checking for common VM/sandbox indicators such as Parallels,
VMware, or kernel debug flags, typical of evasion-aware malware.
tags:
- attack.stealth
- attack.t1497
logsource:
category: process_creation
product: macos
detection:
selection:
CommandLine|contains|all:
- sysctl
- vm.
CommandLine|contains:
- hw.model
- hw.machine
- kern.bootargs
selection_hwinfo:
CommandLine|contains:
- SPHardwareDataType
filter_admin:
User: root
condition: (selection or selection_hwinfo) and not filter_admin
falsepositives:
- System diagnostic tools and IT support scripts
- Hardware inventory collection by MDM solutions
level: medium
id: 70cb78e2-c07b-5e84-99fc-d0316ba41db7
status: experimental
author: Vorant
1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x62.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs