diff --git a/clusters/tool.json b/clusters/tool.json
index 4d7ca668..61965808 100644
--- a/clusters/tool.json
+++ b/clusters/tool.json
@@ -3146,6 +3146,20 @@
           "TRITON"
         ]
       }
+    },
+    {
+      "value": "OSX.Pirrit",
+      "description": "macOS adware strain ",
+      "meta": {
+        "refs": [
+          "http://go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf",
+          "https://www2.cybereason.com/research-osx-pirrit-mac-adware",
+          "https://www.cybereason.com/hubfs/Content%20PDFs/OSX.Pirrit%20Part%20III%20The%20DaVinci%20Code.pdf"
+        ],
+        "synonyms": [
+          "OSX/Pirrit"
+        ]
+      }
     }
   ]
 }