Malicious LaunchAgent masquerading as com.apple.system.services.activity

Duo Tech@duotech

•updated Jul 2, 2026•1•0•4

Detects the creation, modification, or renaming of a specific property list file ('com.apple.system.services.activity') within the macOS LaunchAgents directory, a common technique used by attackers to maintain persistence on compromised systems.