T1543.001
Create or Modify System Process: Launch Agent
discovered 2026-07-11Installs a LaunchAgent at ~/Library/LaunchAgents/com.system.notifications.agent.plist with a 60s StartInterval that polls the C2 for commands, turning the infection into a standing backdoor.
View on MITRE ATT&CK