Obfuscated osascript execution spawned by launchd-based persistence

Ethan Andrews@eandrews

•updated Jul 24, 2026•0•0•6

Detects osascript process execution spawned by launchd/LaunchAgent chains where the invoked AppleScript command line contains obfuscated/encoded content, consistent with EtherHiding's Launch Agent-triggered AppleScript payloads used to query blockchain C2 infrastructure.