Fake Finder.app Bundle Registers via SMAppService for Persistence

Duo Tech@duotech

•updated Jul 6, 2026•2•0•1

Detects the macOS 'Finder' process loading 'ServiceManagement.framework' from a non-standard path within '/Library/Application Support/'. This behavior is highly suspicious as Finder should typically load system frameworks from standard paths, and unexpected module loading in this context may indicate code injection, tampering, or malicious activity disguised as part of the operating system.