Pirrit is aggressive macOS adware, ported from Windows adware and seen on Macs since 2016, that installs a LaunchAgent and a local proxy so it can inject ads into the pages you visit. If ads appear on sites that normally have none, check your proxy settings, browser extensions and LaunchAgents folders.
Last reviewed · 3 sources
Also known as: OSX.Pirrit, Pirrit Adware, OperatorMac
Pirrit has been known on Windows since 2014, and a Mac version was spotted in 2016 (Check Point). Check Point describes it downloading an 'injector' script, installing a LaunchAgent for persistence and setting up a local proxy that redirects web traffic to push ads. In 2021 Patrick Wardle found GoSearch22, an early piece of malicious code built natively for Apple's M1 chip, and identified it as a Pirrit variant. XProtect 5368 (macOS 26.5, checked October 29, 2026) has Pirrit rules and an XProtect Remediator module named Pirrit.
Bundled with free Mac software from third-party download sites
Fake software updates and misleading download buttons on websites
Ads that lead to Pirrit installers
Browser extension installs that bundle adware components
Pop-up ads even on normally ad-free websites
Searches redirected through unfamiliar search engines
A proxy configuration you didn't add
An app named like GoSearch22, or other apps you don't remember installing
Go to System Settings › Network › your connection › Details › Proxies, and turn off any automatic or manual proxy you didn't add.
Check /Applications for recently installed apps you don't recognize, and /Library/Application Support and ~/Library/Application Support for related folders.
Check every browser for extensions you didn't install and remove them by hand.
Remove the adware's plist files from ~/Library/LaunchAgents, /Library/LaunchAgents and /Library/LaunchDaemons, and any profile you didn't install under System Settings › General › Device Management.
CoreLock's free scan includes a startup-items check, which lists the launch items that could reinstall the adware. It can't promise to find every component.
Download software only from the Mac App Store or official developer websites
Be careful with 'Download' buttons on free software sites, which are often ads
Check System Settings › Network for proxy settings you didn't add
Keep automatic security updates on so XProtect Remediator stays current
What it can and can't do
Pirrit keeps itself running with a LaunchAgent, and startup items are one of the six checks in CoreLock's free scan. CoreLock doesn't check proxy settings, so check those by hand, and it can't promise to catch every variant.
It's adware, but more intrusive than most: it routes your web traffic through its own local proxy to inject ads, so it can see and change the pages that pass through it.
It has more than one part: a LaunchAgent that keeps it running, a local proxy, and often browser extensions and helper apps. Remove all of them, or the remaining pieces can put the rest back.
Check Point dates the Mac version to 2016. In 2021 Patrick Wardle found a variant, GoSearch22, built to run natively on M1 Macs, and Apple's XProtect still carries Pirrit rules and a Remediator module today.
Free, with no account: the scan checks your Downloads folder against a built-in malware-hash list and 19 YARA rules.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser