🎯 LaunchAgent persistence

The items that name it 4

• Malicious Claude Code extension on Cursor planted SSH backdoors
  articleas classification.key entities2026-10-30
• Popular Rust crates arrayref, append-only-vec, and internment compromised in Supply Chain Attack
  writeupas techniques2026-08-20It is written here as LaunchAgent persistence (macOS).

  Embeds a LaunchAgent property list template with RunAtLoad, filled in at runtime and written to Library/LaunchAgents, executing a command via /bin/zsh -c

• Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages
  writeupas techniques2026-08-06

  macOS payload creates ~/Library/LaunchAgents/com.apple.windowserver.helper.plist and loads it with launchctl load -w to persist and auto-restart at login

• Threat Actor Targets Crypto Organizations | Wiz Blog
  writeupas techniques2026-05-27

  Persistence established via LaunchAgent with RunAtLoad and KeepAlive flags, masquerading as legitimate apps (e.g. com.microsoft.teams.coreaudiod, com.apple.Terminal.profiler)