Skip to content
Threat Feed

Product

OSX.Pirrit

1 brief RSS
medium advisory

Mac Adware Injecting Malicious JavaScript via Obfuscated Python Script

A Mac adware, likely a component of OSX.Pirrit, uses multiple layers of obfuscation, including base64 encoding, zlib compression, and variable renaming, to evade detection and inject malicious JavaScript from hxxps://1049434604.rsc.cdn77.org/ij1.min.js.

CleanMyMac X +1 adware macos python javascript_injection
2r 2t 1i