Procedure examples

InvisibleFerret has established persistence using LaunchAgents on macOS that run on Startup using a file named “com.avatar.update.wake.plist”.

macOS.OSAMiner has placed a Stripped Payloads with a `plist` extension in the Launch Agent's folder.

NETWIRE can use launch agents for persistence.

Dacls can establish persistence via a LaunchAgent.

Cuckoo Stealer can achieve persistence by creating launch agents to repeatedly execute malicious payloads.

FruitFly persists via a Launch Agent.

Keydnap uses a Launch Agent to persist.

Green Lambert can create a Launch Agent with the `RunAtLoad` key-value pair set to true, ensuring the `com.apple.GrowlHelper.plist` file runs every time a user logs in.

ThiefQuest installs a launch item using an embedded encrypted launch agent property list template. The plist file is installed in the ~/Library/LaunchAgents/ folder and configured with the path to the persistent binary located in the ~/Library/ folder.

Bundlore can persist via a LaunchAgent.

GlassWorm has established persistence on macOS via a LaunchAgent by writing a plist under `/library/LaunchAgents`.

CrossRAT creates a Launch Agent on macOS.

OSX_OCEANLOTUS.D can create a persistence file in the folder /Library/LaunchAgents.

Calisto adds a .plist file to the /Library/LaunchAgents folder to maintain persistence.

MacMa installs a `com.apple.softwareupdate.plist` file in the `/LaunchAgents` folder with the `RunAtLoad` value set to `true`. Upon user login, MacMa is executed from `/var/root/.local/softwareupdate` with root privileges. Some variations also include the `LimitLoadToSessionType` key with the value `Aqua`, ensuring the MacMa only runs when there is a logged in GUI user.

Proton persists via Launch Agent.

CoinTicker creates user launch agents named .espl.plist and com.apple.[random string].plist to establish persistence.

CookieMiner has installed multiple new Launch Agents in order to maintain persistence for cryptocurrency mining software.

The Komplex trojan creates a persistent launch agent called with $HOME/Library/LaunchAgents/com.apple.updates.plist with launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plist.

Dok installs two LaunchAgents to redirect all network traffic with a randomly generated name for each plist file maintaining the format com.random.name.plist.

MacSpy persists via a Launch Agent.

Mini Shai-Hulud has established persistence on macOS hosts by installing a gh-token-monitor daemon through LaunchAgent that polls GitHub every 60 seconds.