macOS Crypto-Draining Stealer LaunchAgent Persistence & Quarantine Removal

Emiliano Mema@Nosalva

•updated Aug 28, 2026•0•0•3

Detects macOS persistence mechanism involving the registration of a disguised LaunchAgent via 'launchctl bootstrap', storing payloads in paths masquerading as system cache directories, and the subsequent removal of the 'com.apple.quarantine' extended attribute using 'xattr' to bypass Gatekeeper execution restrictions.