macOS CountLoader LaunchAgent persistence via correlated plist creation and launchctl load

Duo Tech@duotech

•updated Aug 6, 2026•3•0•2

Detects macOS persistence via launchctl loading a LaunchAgent plist within 300 seconds of that plist file being created in /Library/LaunchAgents/, a technique associated with the DOUBLECUP loader delivering CountLoader and DeviceManager RATs.