macOS.Gaslight LaunchAgent Persistence via com.apple.system.services.activity

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•4

Detects the creation of a LaunchAgent property list (.plist) file on macOS that uses a spoofed Apple namespace label (com.apple.system.services.activity). This behavior is characteristic of the Gaslight malware family attempting to establish persistence.