BlueNoroff macOS Persistence Via Launch Agent

Tim Peck@timpeck

•updated Jan 20, 2026•6•0•105

Detects the creation of a macOS Launch Agent by a suspicious process or with a name matching patterns used by the BlueNoroff group. BlueNoroff uses Launch Agents for persistence on compromised macOS systems.