COOKIE SPIDER SHAMOS Malware Campaign Targeting macOS (Persistence via LaunchDaemons Creation)

Kaung Khant Ko@kaungkhantko

•updated Sep 9, 2025•4•4•77

Detects the creation of a .plist file in macOS LaunchAgents or LaunchDaemons directories, a technique used by SHAMOS malware for persistence. This rule looks for the specific SHAMOS plist file or for any plist created by a process running from a suspicious location.