This article has been created with the main purpose of explaining what is Pirrit Adware and how you can make sure to stop advertisements coming from it on your Mac.
SIDENOTE: This post was originally published in August 2018. But we gave it an update in August 2019.
An adware program for Mac, known as Pirrit has been detected to still be active ever since it’s first launch in early 2018. The adware aims to infect computers while remaining undetected and in addition to this display a lot of advertisements on the Macs of users. The Pirrit adware may also collect data from the affected Macs and also lead users to third-party sites that may be of a scamming or malicious character. If you see advertisements, that are related to Pirrit adware, we strongly suggest that you read this article as it aims to help you remove this unwanted program from your Mac.
|Type||Adware/PUP for Mac OS|
|Short Description||Aims to display a wide variety of advertisements on your Mac that aim to get you to visit third-party sites of suspicious origin to likely generate the developers of Pirrit profit.|
|Symptoms||You may see a rich array of advertisemetns, that may lead you to third-party sites.|
|Distribution Method||Via bundling of setups or via other unwanted software or suspicious websites.|
|Detection Tool|| See If Your System Has Been Affected by Pirrit |
|User Experience||Join Our Forum to Discuss Pirrit.|
Pirrit Adware – How Did I Get It
The primary method by which this virus spreads according to researchers is reported to likely be via an online marketing company’s website, known as TargetingEdge, which may be based in Israel. In addition to this, another likely method of replication of OSX.Pirrit is likely via software bundling that disguises this unwanted program as something that is of a helpful nature and is added as a free extra to a free program the user is trying to install. Such free programs are your average video converter app or an app that helps you download free media content. Usually these free apps are available on third-party sites, where Pirrit may also be offered as an addition in their installers or even may be automatically added alongside them.
There is no specific information about the TargetingEdge company, but it is clear that It is related to several other companies as it’s website suggests:
TargetingEdge is related to two other companies, TLV Media, which makes an ad targeting and ad monetization platform, and Feature Forward, which sells a video platform. According to LinkedIn, all three companies have the same board of directors and the executive who created the OSX.Pirrit variant previously worked for TLV Media.
Furthermore, in a research on Pirrit, done by Amit Serper, a security analyst at Cybereason, the company was also reported to likely be associated with such activity for quite some time. And not only this but the Pirrit adware has similar activity to malware infections.
Pirrit Adware – Activity and More Information
If your Mac has been affected by this adware, be advised that this is not a new program. Several years ago, the program was in it’s Windows version where it was detected to heavily display ads on the victim PC. But it’s Mac OS version is quite different and has more malware features added to it:
Attackers could have used the capabilities built into OSX.Pirrit to install a keylogger and steal your log-in credentials or make off with your company’s intellectual property, among many other bad outcomes.
Furthrmore, the malware has also been reported to be far more dangerous than it’s traditional Windows variant In the sense that it has a lot of capabilities added to it’s Mac version and some of them have nothing to do with adware, because they may be able to obtain the following information from your Mac:
- The keystrokes you type.
- Live feed from your camera.
- Sound recording from your microphone.
- Taking screenshots.
- Obtaining saved passwords on your web browser.
- Getting information regarding the apps installed on your Mac.
- Info about what you search for and type online.
Furthermore, in addition to this, the creators of the Pirrit adware may also have left a tar.gz archive, with data that could eventually lead researchers to tracking the actual malware creators.
Programs, like Pirrit adware are nothing new for Mac machines, and the program itself may not be a direct threat to the Mac, even though it users some malicious practices, like key logging. What may be dangerous is that this adware may show different types content from third-party sites, such as:
- Browser Redirects.
- Ad-supported search results.
- Taken over Banner spaces on the sites you visit.
Since these advertisements may lead victims to pay-per-click sites or other unwanted websites that may be of a scamming or malicious type, It is strongly advisable to remove Pirrit adware if you encounter it on your Mac.
Remove Pirrit Adware and Stop Pop-ups on Your Mac
If you want to remove Pirrit from your Mac, you will first need to identify what type of program is the adware disguised as and remove it as an app. Then, you should look for leftover files or changed DNS settings on your Mac that may lead to this adware still being active on your Mac. For maximum effectiveness, be advised that security experts always recommend to remove such ad-supported programs with the aid of an advanced anti-malware software, capable of automatically scanning and removing all malicious files from your Mac plus optimizing it so that it remains fast and protected in the future.