Phexia LaunchAgent loader: base64 pipe to osascript run by bash via launchd

ills3c Intel&Coffee@Ills3C

•updated yesterday•0•0•0

Detects the Phexia macOS dropper persistence mechanism where a shell script writes a plist file into ~/Library/LaunchAgents, reloads it using launchctl, and subsequently executes a base64 encoded payload piped into osascript via a shell interpreter.