Meow RAT macOS LaunchAgent/LaunchDaemon Persistence via osascript

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•7

Detects the creation of plist files within macOS /Library/LaunchAgents/ or /Library/LaunchDaemons/ directories by the osascript utility. This behavior is indicative of Meow RAT establishing persistence by masquerading as a legitimate system service.