Subject: Re: High CPU usage from piradex.com in Safari Web Content
The key observation is that force-quitting the piradex.com Web Content process immediately returns CPU usage to normal, but the process soon reappears. This suggests Safari, or another app using Apple's WebKit framework, is repeatedly loading content associated with that domain.
This does not prove infection: webpages and apps can load third-party content without you visiting the domain.
I would identify what triggers the connection before reinstalling or erasing macOS.
1. In Safari, enable the Develop menu in Safari > Settings > Advanced, then choose Develop > Show Web Inspector. Check Network activity for requests to piradex.com. Try to identify the page, frame or script making the request.
Apple guide: https://developer.apple.com/documentation/safari-developer-tools/web-inspector
Also try Develop > Inspect Apps and Devices. WebKit content may originate in another application, not just a Safari tab.
https://developer.apple.com/documentation/safari-developer-tools/inspect-apps-and-devices
2. Review Safari > Settings > Websites for unfamiliar permissions, especially Notifications, Pop-up Windows and Automatic Downloads. Check General for the homepage and startup behaviour. Close all tabs, including pinned tabs, and avoid restoring previous windows during testing.
Apple guide: https://support.apple.com/en-ca/102564
3. Temporarily turn off Safari syncing in iCloud settings. Restart the Mac, open Safari without restoring tabs, and leave it open without visiting websites. Check Activity Monitor to see whether the process returns.
A new account may still receive Safari data through the same Apple Account.
Apple guide: https://support.apple.com/en-ca/guide/icloud/mm9b8da4f328/icloud
4. Since it affects a new account, review System Settings > General > Login Items & Extensions, Device Management, VPN/proxy and DNS settings, and third-party security or network-filtering software.
Apple guides: Login items: https://support.apple.com/en-ca/guide/mac-help/mh15189/27/mac/27
Device management: https://support.apple.com/en-ca/guide/mac-help/mh35474/27/mac/27
Check /Library/LaunchAgents/, /Library/LaunchDaemons/ and ~/Library/LaunchAgents/ for unfamiliar items, but do not delete anything until identified. Disabling Peng Antai made no difference, so its involvement is unproven.
5. Restart the Mac, disconnect from the internet, then open Safari without restoring tabs. Wait several minutes and monitor Activity Monitor. Reconnect while Safari remains open and watch for piradex.com.
If it appears only after reconnecting, a network-triggered request is more likely. If it appears offline, investigate session restoration or other local WebKit activity.
6. When the process appears, note its PID in Activity Monitor, select it, then choose View > Sample Process and save the report. If possible, also collect a System Diagnostics report.
Apple guide: https://support.apple.com/guide/activity-monitor/run-system-diagnostics-actmntr2225/mac
The sample may help identify JavaScript, rendering or other WebKit activity.
7. Never having visited the domain is worth investigating, but does not prove malware. A page or app may request third-party content in the background. Avoid visiting it; identify the source of the request.
8. I would not erase the Mac yet. A reinstall generally preserves accounts, apps and data, so it may not remove a cause tied to an app or synchronized settings.
Reinstall instructions: https://support.apple.com/en-ca/102655
A clean erase should be a last resort. If you do this, set up the Mac as new and test Safari before restoring a backup, enabling iCloud syncing or reinstalling third-party apps. Otherwise, you may reintroduce the cause.
Apple-silicon erase instructions: https://support.apple.com/en-ca/102506
9. Could you establish:
- Does the process appear immediately after opening Safari with no tabs?
- Does it appear while Safari is open but the Mac is offline?
- Does it persist with iCloud Safari syncing disabled?
- Can Web Inspector identify the page, frame or script making the request?
- Does the Activity Monitor sample reveal what the process is doing?
My recommendation: Identify the trigger before reinstalling or erasing macOS. The process returning after force-quit confirms recurring activity, not its source.
If these tests do not resolve it, contact Apple Support and provide the process sample and diagnostic report:
