T1543.001

Create or Modify System Process: Launch Agent

discovered 2026-07-11

Installs a LaunchAgent at ~/Library/LaunchAgents/com.system.notifications.agent.plist with a 60s StartInterval that polls the C2 for commands, turning the infection into a standing backdoor.

View on MITRE ATT&CK

Seen in packages

Campaigns