Launchctl Persistence via JINX-0164 Job Names

Ethan Andrews@eandrews

•updated May 29, 2026•1•0•10

Detects the execution of 'launchctl submit' with specific job names ('chrome.job' or 'coreaudio.job') that have been observed in JINX-0164 macOS campaigns to establish persistence.