Mac ClickFix - Keystone Agent Masqueraded Persistence (T1543.001)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•3

Identifies the creation of a LaunchAgent property list masquerading as 'com.google.keystone.agent.plist'. This behavior is associated with the ClickFix campaign, which uses fake macOS utilities to deliver infostealers.