macOS.Gaslight LaunchAgent Persistence via Apple Namespace Masquerade

Ethan Andrews@eandrews

•updated Jun 24, 2026•0•0•11

Detects macOS.Gaslight DPRK-aligned implant registering a LaunchAgent plist using the com.apple.system.services.activity label to masquerade within Apple's com.apple.* namespace for persistence. Key behavioral indicators include file writes to ~/Library/LaunchAgents with the spoofed label and use of __NSGetExecutablePath for binary path resolution.