Pirrit is a persistent macOS adware first seen in 2016. It emerged again in late 2021 with new activity. Typically installed via malicious DMG files, Pirrit changes browser settings, installs tracking extensions, and configures a local proxy to inject ads. It maintains persistence using a LaunchAgent and hidden user account. With full system control, it could theoretically steal sensitive user data. Pirrit often drops payloads in random 8-character directories under /tmp and Application Support. The adware is relatively advanced in its evasion techniques. For example, it checks for virtual machines before continuing execution to evade analysis and detection.