macOS.Gaslight LaunchAgent Persistence with com.apple.* Namespace Masquerade

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects the creation of a LaunchAgent property list file in the user's Library directory that masquerades as an Apple-related process (com.apple.*). This behavior is associated with the macOS.Gaslight malware family, which uses such files for persistence, often with specific arguments like --type=renderer.