LiveActive security incident?Get immediate response
MITRE ATT&CK® Technique

T1543.001: Launch Agent

Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in /System/Library/LaunchAgents, /Library/LaunchAgents, and ~/Library/LaunchAgents.[1][2] [3] Property list files use the Label, ProgramArguments , and RunAtLoad keys to identify the Launch Agent's name, executable location, and execution time.[4] Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.

Launch Agents can also be executed using the Launchctl command. Adversaries may install a new Launch Agent that executes at login by placing a .plist file into the appropriate folders with the RunAtLoad or KeepAlive keys set to true.[5][6] The Launch Agent name may be disguised by using a name from the related operating system or benign software. Launch Agents are created with user level privileges and execute with user level permissions.[7][8]

EnterpriseT1543.001Sub-techniqueObject v1.5Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Launch Agent abuse is a macOS persistence technique: a malicious or modified .plist can cause code to run when a user logs in or when launchd loads it. For leaders, the business issue is not the file format itself; it is whether Mac endpoints used by developers, executives, finance, or cryptocurrency-related staff can retain unauthorized code across reboots and user sessions without being noticed.

Executive priority

Prioritize this where macOS systems have access to sensitive data, source code, credentials, administrative tools, or regulated workflows. The key management question is whether the organization can prove control over user-level persistence locations, detect unexpected Launch Agent changes, and respond quickly enough to remove persistence before credential theft, data access, or longer dwell time occurs. This technique also supports audit and compliance conversations around endpoint hardening, least privilege, and evidence of monitoring for persistence mechanisms.

Technical view

This is a macOS sub-technique of Create or Modify System Process for persistence and privilege-escalation tactics. Validate monitoring of .plist creation or modification in /System/Library/LaunchAgents, /Library/LaunchAgents, and ~/Library/LaunchAgents, with attention to Launch Agent keys such as Label, ProgramArguments, RunAtLoad, and KeepAlive. Because ATT&CK does not provide official detection text for this object, detection engineering should align to the related DET0434 strategy and test whether file monitoring, process telemetry, and launchctl-related activity are actually visible on managed Macs. Relationship context shows broad use across macOS malware and multi-platform RATs, so triage should treat suspicious Launch Agents as persistence leads that may connect to credential access, backdoors, proxying, or mining behavior depending on local evidence.

Likely telemetry

  • macOS file creation, modification, ownership, and permission changes in LaunchAgents directories
  • Contents of Launch Agent .plist files, especially Label, ProgramArguments, RunAtLoad, and KeepAlive keys
  • Process execution telemetry for payloads launched by launchd
  • Command execution telemetry involving launchctl where collected
  • Endpoint security or EDR alerts tied to user-level persistence on macOS

Detection direction

  • Validate coverage for creation or modification of .plist files in system, library, and user LaunchAgents paths; user home directories are a common blind spot.
  • Tune detections to distinguish expected software updaters and developer tools from unusual labels, suspicious executable paths, newly introduced RunAtLoad or KeepAlive entries, or mismatches between plist name and referenced binary.
  • Correlate Launch Agent changes with subsequent launchd-spawned process execution rather than relying only on static file presence.
  • Review whether launchctl execution is logged and whether it can be tied to the user, parent process, and modified plist.
  • Use allowlists carefully: Launch Agents are legitimate macOS functionality, so false positives are likely without baselines for managed software and normal developer workflows.

Mitigation priorities

  • Apply least-privilege file and directory permissions, consistent with mitigation M1022, to limit unnecessary write access to sensitive LaunchAgents locations.
  • Baseline approved Launch Agents on managed macOS endpoints and review deviations through change control or endpoint management evidence.
  • Reduce local administrative or unnecessary write privileges where business operations allow, especially for high-risk user populations.
  • Ensure endpoint management and response procedures can remove both malicious .plist files and referenced payloads.
  • Include Launch Agent persistence checks in macOS hardening reviews, incident response playbooks, and compliance evidence collection.
Additional notes and limits

The object is macOS-specific and user-level Launch Agents execute with user-level permissions. ATT&CK relationships show this technique is used by multiple named malware families and tools, including Komplex, NETWIRE, CrossRAT, Keydnap, Proton, Dok, Bundlore, CookieMiner, Dacls, MacMa, macOS.OSAMiner, and Cuckoo Stealer, plus the Contagious Interview group relationship. Those relationships justify defensive prioritization but should not be treated as evidence of current activity in a specific environment without local telemetry.

Official ATT&CK detection text is not provided for this object. The take relies on the official description, external references, and supplied relationships, including DET0434 and M1022. Local endpoint visibility, software inventory, user privilege model, and normal macOS administration practices are required to determine actual exposure and detection quality.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Launch Agent

Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in /System/Library/LaunchAgents, /Library/LaunchAgents, and ~/Library/LaunchAgents.[1][2] [3] Property list files use the Label, ProgramArguments , and RunAtLoad keys to identify the Launch Agent's name, executable location, and execution time.[4] Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.

Launch Agents can also be executed using the Launchctl command. Adversaries may install a new Launch Agent that executes at login by placing a .plist file into the appropriate folders with the RunAtLoad or KeepAlive keys set to true.[5][6] The Launch Agent name may be disguised by using a name from the related operating system or benign software. Launch Agents are created with user level privileges and execute with user level permissions.[7][8]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

2 rows
DomainIDNameRelationship / procedure
EnterpriseT1159Launch AgentLaunch Agent revoked by this object.
EnterpriseT1543Create or Modify System ProcessThis object subtechnique of Create or Modify System Process.
Associated objects

Groups, software, and campaigns

MalwareEnterprise

S9010: GlassWorm

GlassWorm is a worm that propagated through supply chain attacks by compromising repository credentials from victim environments and having malicious payloads added to those compromised accounts for distribution to victims across the various development ecosystems.[1][2][3] GlassWorm has numerous variants, including Rust binaries, encrypted JavaScript and a variant leveraging invisible Unicode characters that made reverse engineering difficult.[4][1][5] GlassWorm has employed a unique command and control (C2) methodology using Solana blockchain.[6][1] GlassWorm was first reported in October 2025.[6][1][3]

macOSWindows
MalwareEnterprise

S1016: MacMa

MacMa is a macOS-based backdoor with a large set of functionalities to control and exfiltrate files from a compromised computer. MacMa has been observed in the wild since November 2021.[1] MacMa shares command and control and unique libraries with MgBot and Nightdoor, indicating a relationship with the Daggerfly threat actor.[2]

macOS
MalwareEnterprise

S0482: Bundlore

Bundlore is adware written for macOS that has been in use since at least 2015. Though categorized as adware, Bundlore has many features associated with more traditional backdoors.[1]

macOS
MalwareEnterprise

S0595: ThiefQuest

ThiefQuest is a virus, data stealer, and wiper that presents itself as ransomware targeting macOS systems. ThiefQuest was first seen in 2020 distributed via trojanized pirated versions of popular macOS software on Russian forums sharing torrent links.[1] Even though ThiefQuest presents itself as ransomware, since the dynamically generated encryption key is never sent to the attacker it may be more appropriately thought of as a form of wiper malware.[2][3]

macOS
MalwareEnterprise

S1048: macOS.OSAMiner

macOS.OSAMiner is a Monero mining trojan that was first observed in 2018; security researchers assessed macOS.OSAMiner may have been circulating since at least 2015. macOS.OSAMiner is known for embedding one run-only AppleScript into another, which helped the malware evade full analysis for five years due to a lack of Apple event (AEVT) analysis tools.[1][2]

macOS
Relationship explorer

All related ATT&CK context

uses · MalwareS0274: CalistoEnterprisedetects · Detection StrategyDET0434: Detection of Launch Agent Creation or Modification on macOSEnterpriseuses · MalwareS0279: ProtonEnterpriseuses · MalwareS9010: GlassWormEnterpriseuses · MalwareS0282: MacSpyEnterpriseuses · MalwareS0235: CrossRATEnterpriseuses · MalwareS0281: DokEnterpriseuses · MalwareS0497: DaclsEnterpriseuses · MalwareS1016: MacMaEnterpriserevoked by · TechniqueT1159: Launch AgentEnterpriseuses · MalwareS0352: OSX_OCEANLOTUS.DEnterprisemitigates · MitigationM1022: Restrict File and Directory PermissionsEnterpriseuses · MalwareS0482: BundloreEnterpriseuses · GroupG1052: Contagious InterviewEnterprisesubtechnique of · TechniqueT1543: Create or Modify System ProcessEnterpriseuses · MalwareS0595: ThiefQuestEnterpriseuses · MalwareS1048: macOS.OSAMinerEnterpriseuses · MalwareS1245: InvisibleFerretEnterpriseuses · MalwareS0369: CoinTickerEnterpriseuses · MalwareS0690: Green LambertEnterpriseuses · MalwareS1153: Cuckoo StealerEnterpriseuses · MalwareS0492: CookieMinerEnterpriseuses · MalwareS0277: FruitFlyEnterpriseuses · MalwareS0162: KomplexEnterprise
Mitigations

Mitigation direction

MitigationEnterprise

M1022: Restrict File and Directory Permissions

Restricting file and directory permissions involves setting access controls at the file system level to limit which users, groups, or processes can read, write, or execute files. By configuring permissions appropriately, organizations can reduce the attack surface for adversaries seeking to access sensitive data, plant malicious code, or tamper with system files.

Enforce Least Privilege Permissions:

- Remove unnecessary write permissions on sensitive files and directories. - Use file ownership and groups to control access for specific roles.

Example (Windows): Right-click the shared folder → Properties → Security tab → Adjust permissions for NTFS ACLs.

Harden File Shares:

- Disable anonymous access to shared folders. - Enforce NTFS permissions for shared folders on Windows.

Example: Set permissions to restrict write access to critical files, such as system executables (e.g., `/bin` or `/sbin` on Linux). Use tools like `chown` and `chmod` to assign file ownership and limit access.

On Linux, apply: `chmod 750 /etc/sensitive.conf` `chown root:admin /etc/sensitive.conf`

File Integrity Monitoring (FIM):

- Use tools like Tripwire, Wazuh, or OSSEC to monitor changes to critical file permissions.

Audit File System Access:

- Enable auditing to track permission changes or unauthorized access attempts. - Use auditd (Linux) or Event Viewer (Windows) to log activities.

Restrict Startup Directories:

- Configure permissions to prevent unauthorized writes to directories like `C:\ProgramData\Microsoft\Windows\Start Menu`.

Example: Restrict write access to critical directories like `/etc/`, `/usr/local/`, and Windows directories such as `C:\Windows\System32`.

- On Windows, use icacls to modify permissions: `icacls "C:\Windows\System32" /inheritance:r /grant:r SYSTEM:(OI)(CI)F` - On Linux, monitor permissions using tools like `lsattr` or `auditd`.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.5
Created
Modified
Raw hash
4637da87f6e9035c...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.5Current bundle4637da87f6e9…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    AppleDocs Launch Agent Daemons

    Apple. (n.d.). Creating Launch Daemons and Agents. Retrieved July 10, 2017.

    Open source URL
  2. [2]
    OSX Keydnap malware

    Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware is hungry for credentials. Retrieved July 3, 2017.

    Open source URL
  3. [3]
    Antiquated Mac Malware

    Thomas Reed. (2017, January 18). New Mac backdoor using antiquated code. Retrieved July 5, 2017.

    Open source URL
  4. [4]
    OSX.Dok Malware

    Thomas Reed. (2017, July 7). New OSX.Dok malware intercepts web traffic. Retrieved July 10, 2017.

    Open source URL
  5. [5]
    Sofacy Komplex Trojan

    Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.

    Open source URL
  6. [6]
    Methods of Mac Malware Persistence

    Patrick Wardle. (2014, September). Methods of Malware Persistence on Mac OS X. Retrieved July 5, 2017.

    Open source URL
  7. [7]
    OSX Malware Detection

    Patrick Wardle. (2016, February 29). Let's Play Doctor: Practical OS X Malware Detection & Analysis. Retrieved November 17, 2024.

    Open source URL
  8. [8]
    OceanLotus for OS X

    Eddie Lee. (2016, February 17). OceanLotus for OS X - an Application Bundle Pretending to be an Adobe Flash Update. Retrieved July 5, 2017.

    Open source URL
  9. [9]
    Securelist Calisto July 2018

    Kuzin, M., Zelensky S. (2018, July 20). Calisto Trojan for macOS. Retrieved September 7, 2018.

    Open source URL
  10. [10]
    objsee mac malware 2017

    Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.

    Open source URL
  11. [11]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  12. [12]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  13. [13]
    Lookout Dark Caracal Jan 2018

    Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.

    Open source URL
  14. [14]
    CheckPoint Dok

    Ofer Caspi. (2017, May 4). OSX Malware is Catching Up, and it wants to Read Your HTTPS Traffic. Retrieved October 5, 2021.

    Open source URL
  15. [15]
    SentinelOne Lazarus macOS July 2020

    Stokes, P. (2020, July 27). Four Distinct Families of Lazarus Malware Target Apple’s macOS Platform. Retrieved August 7, 2020.

    Open source URL
  16. [16]
    TrendMicro macOS Dacls May 2020

    Mabutas, G. (2020, May 11). New MacOS Dacls RAT Backdoor Shows Lazarus’ Multi-Platform Attack Capability. Retrieved August 10, 2020.

    Open source URL
  17. [17]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  18. [18]
    Objective-See MacMa Nov 2021

    Wardle, P. (2021, November 11). OSX.CDDS (OSX.MacMa). Retrieved June 30, 2022.

    Open source URL
  19. [19]
    TrendMicro MacOS April 2018

    Horejsi, J. (2018, April 04). New MacOS Backdoor Linked to OceanLotus Found. Retrieved November 13, 2018.

    Open source URL
  20. [20]
    Trend Micro MacOS Backdoor November 2020

    Magisa, L. (2020, November 27). New MacOS Backdoor Connected to OceanLotus Surfaces. Retrieved December 2, 2020.

    Open source URL
  21. [21]
    piazza launch agent mitigation

    Antonio Piazza (4n7m4n). (2021, November 23). Defeating Malicious Launch Persistence. Retrieved April 19, 2022.

    Open source URL
  22. [22]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  23. [23]
    Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024

    Seongsu Park. (2024, November 4). From Pyongyang to Your Payroll: The Rise of North Korean Remote Workers in the West. Retrieved October 17, 2025.

    Open source URL
  24. [24]
    Sekoia ClickFake 2025

    Amaury G., Coline Chavane, Felix Aimé and Sekoia TDR. (2025, March 31). From Contagious to ClickFake Interview: Lazarus leveraging the ClickFix tactic. Retrieved April 1, 2025.

    Open source URL
  25. [25]
    wardle evilquest parti

    Patrick Wardle. (2020, June 29). OSX.EvilQuest Uncovered part i: infection, persistence, and more!. Retrieved March 18, 2021.

    Open source URL
  26. [26]
    SentinelLabs reversing run-only applescripts 2021

    Phil Stokes. (2021, January 11). FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts. Retrieved September 29, 2022.

    Open source URL
  27. [27]
    CoinTicker 2019

    Thomas Reed. (2018, October 29). Mac cryptocurrency ticker app installs backdoors. Retrieved April 23, 2019.

    Open source URL
  28. [28]
    Objective See Green Lambert for OSX Oct 2021

    Sandvik, Runa. (2021, October 1). Made In America: Green Lambert for OS X. Retrieved March 21, 2022.

    Open source URL
  29. [29]
    Glitch-Cat Green Lambert ATTCK Oct 2021

    Sandvik, Runa. (2021, October 18). Green Lambert and ATT&CK. Retrieved November 17, 2024.

    Open source URL
  30. [30]
    Kandji Cuckoo April 2024

    Kohler, A. and Lopez, C. (2024, April 30). Malware: Cuckoo Behaves Like Cross Between Infostealer and Spyware. Retrieved August 20, 2024.

    Open source URL
  31. [31]
    SentinelOne Cuckoo Stealer May 2024

    Stokes, P. (2024, May 9). macOS Cuckoo Stealer | Ensuring Detection and Defense as New Samples Rapidly Emerge. Retrieved August 20, 2024.

    Open source URL
  32. [32]
    Unit42 CookieMiner Jan 2019

    Chen, y., et al. (2019, January 31). Mac Malware Steals Cryptocurrency Exchanges’ Cookies. Retrieved July 22, 2020.

    Open source URL
  33. [33]
    Red Canary NETWIRE January 2020

    Lambert, T. (2020, January 29). Intro to Netwire. Retrieved January 7, 2021.

    Open source URL
  34. [34]
    synack 2016 review

    Patrick Wardle. (2017, January 1). Mac Malware of 2016. Retrieved September 21, 2018.

    Open source URL
  35. [35]
    Antiquated Mac Malware

    Thomas Reed. (2017, January 18). New Mac backdoor using antiquated code. Retrieved July 5, 2017.

    Open source URL
  36. [36]
    Antiquated Mac Malware

    Thomas Reed. (2017, January 18). New Mac backdoor using antiquated code. Retrieved July 5, 2017.

    Open source URL
  37. [37]
    AppleDocs Launch Agent Daemons

    Apple. (n.d.). Creating Launch Daemons and Agents. Retrieved July 10, 2017.

    Open source URL
  38. [38]
    AppleDocs Launch Agent Daemons

    Apple. (n.d.). Creating Launch Daemons and Agents. Retrieved July 10, 2017.

    Open source URL
  39. [39]
    Methods of Mac Malware Persistence

    Patrick Wardle. (2014, September). Methods of Malware Persistence on Mac OS X. Retrieved July 5, 2017.

    Open source URL
  40. [40]
    Methods of Mac Malware Persistence

    Patrick Wardle. (2014, September). Methods of Malware Persistence on Mac OS X. Retrieved July 5, 2017.

    Open source URL
  41. [41]
    OSX Keydnap malware

    Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware is hungry for credentials. Retrieved July 3, 2017.

    Open source URL
  42. [42]
    OSX Keydnap malware

    Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware is hungry for credentials. Retrieved July 3, 2017.

    Open source URL
  43. [43]
    OSX Malware Detection

    Patrick Wardle. (2016, February 29). Let's Play Doctor: Practical OS X Malware Detection & Analysis. Retrieved November 17, 2024.

    Open source URL
  44. [44]
    OSX Malware Detection

    Patrick Wardle. (2016, February 29). Let's Play Doctor: Practical OS X Malware Detection & Analysis. Retrieved November 17, 2024.

    Open source URL
  45. [45]
    OSX.Dok Malware

    Thomas Reed. (2017, July 7). New OSX.Dok malware intercepts web traffic. Retrieved July 10, 2017.

    Open source URL
  46. [46]
    OSX.Dok Malware

    Thomas Reed. (2017, July 7). New OSX.Dok malware intercepts web traffic. Retrieved July 10, 2017.

    Open source URL
  47. [47]
    OceanLotus for OS X

    Eddie Lee. (2016, February 17). OceanLotus for OS X - an Application Bundle Pretending to be an Adobe Flash Update. Retrieved July 5, 2017.

    Open source URL
  48. [48]
    OceanLotus for OS X

    Eddie Lee. (2016, February 17). OceanLotus for OS X - an Application Bundle Pretending to be an Adobe Flash Update. Retrieved July 5, 2017.

    Open source URL
  49. [49]
    Sofacy Komplex Trojan

    Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.

    Open source URL
  50. [50]
    Sofacy Komplex Trojan

    Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.

    Open source URL
  51. [51]
    mitre-attackT1543.001
    Open source URL
  52. [52]
    mitre-attackT1543.001
    Open source URL
  53. [53]
    mitre-attackT1543.001
    Open source URL
  54. [54]
    Securelist Calisto July 2018

    Kuzin, M., Zelensky S. (2018, July 20). Calisto Trojan for macOS. Retrieved September 7, 2018.

    Open source URL
  55. [55]
    objsee mac malware 2017

    Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.

    Open source URL
  56. [56]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  57. [57]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  58. [58]
    objsee mac malware 2017

    Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.

    Open source URL
  59. [59]
    objsee mac malware 2017

    Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.

    Open source URL
  60. [60]
    Lookout Dark Caracal Jan 2018

    Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.

    Open source URL
  61. [61]
    CheckPoint Dok

    Ofer Caspi. (2017, May 4). OSX Malware is Catching Up, and it wants to Read Your HTTPS Traffic. Retrieved October 5, 2021.

    Open source URL
  62. [62]
    objsee mac malware 2017

    Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.

    Open source URL
  63. [63]
    objsee mac malware 2017

    Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.

    Open source URL
  64. [64]
    SentinelOne Lazarus macOS July 2020

    Stokes, P. (2020, July 27). Four Distinct Families of Lazarus Malware Target Apple’s macOS Platform. Retrieved August 7, 2020.

    Open source URL
  65. [65]
    TrendMicro macOS Dacls May 2020

    Mabutas, G. (2020, May 11). New MacOS Dacls RAT Backdoor Shows Lazarus’ Multi-Platform Attack Capability. Retrieved August 10, 2020.

    Open source URL
  66. [66]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  67. [67]
    Objective-See MacMa Nov 2021

    Wardle, P. (2021, November 11). OSX.CDDS (OSX.MacMa). Retrieved June 30, 2022.

    Open source URL
  68. [68]
    Trend Micro MacOS Backdoor November 2020

    Magisa, L. (2020, November 27). New MacOS Backdoor Connected to OceanLotus Surfaces. Retrieved December 2, 2020.

    Open source URL
  69. [69]
    TrendMicro MacOS April 2018

    Horejsi, J. (2018, April 04). New MacOS Backdoor Linked to OceanLotus Found. Retrieved November 13, 2018.

    Open source URL
  70. [70]
    piazza launch agent mitigation

    Antonio Piazza (4n7m4n). (2021, November 23). Defeating Malicious Launch Persistence. Retrieved April 19, 2022.

    Open source URL
  71. [71]
    MacKeeper Bundlore Apr 2019

    Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.

    Open source URL
  72. [72]
    Sekoia ClickFake 2025

    Amaury G., Coline Chavane, Felix Aimé and Sekoia TDR. (2025, March 31). From Contagious to ClickFake Interview: Lazarus leveraging the ClickFix tactic. Retrieved April 1, 2025.

    Open source URL
  73. [73]
    Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024

    Seongsu Park. (2024, November 4). From Pyongyang to Your Payroll: The Rise of North Korean Remote Workers in the West. Retrieved October 17, 2025.

    Open source URL
  74. [74]
    wardle evilquest parti

    Patrick Wardle. (2020, June 29). OSX.EvilQuest Uncovered part i: infection, persistence, and more!. Retrieved March 18, 2021.

    Open source URL
  75. [75]
    SentinelLabs reversing run-only applescripts 2021

    Phil Stokes. (2021, January 11). FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts. Retrieved September 29, 2022.

    Open source URL
  76. [76]
    Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024

    Seongsu Park. (2024, November 4). From Pyongyang to Your Payroll: The Rise of North Korean Remote Workers in the West. Retrieved October 17, 2025.

    Open source URL
  77. [77]
    Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024

    Seongsu Park. (2024, November 4). From Pyongyang to Your Payroll: The Rise of North Korean Remote Workers in the West. Retrieved October 17, 2025.

    Open source URL
  78. [78]
    CoinTicker 2019

    Thomas Reed. (2018, October 29). Mac cryptocurrency ticker app installs backdoors. Retrieved April 23, 2019.

    Open source URL
  79. [79]
    Glitch-Cat Green Lambert ATTCK Oct 2021

    Sandvik, Runa. (2021, October 18). Green Lambert and ATT&CK. Retrieved November 17, 2024.

    Open source URL
  80. [80]
    Objective See Green Lambert for OSX Oct 2021

    Sandvik, Runa. (2021, October 1). Made In America: Green Lambert for OS X. Retrieved March 21, 2022.

    Open source URL
  81. [81]
    Kandji Cuckoo April 2024

    Kohler, A. and Lopez, C. (2024, April 30). Malware: Cuckoo Behaves Like Cross Between Infostealer and Spyware. Retrieved August 20, 2024.

    Open source URL
  82. [82]
    SentinelOne Cuckoo Stealer May 2024

    Stokes, P. (2024, May 9). macOS Cuckoo Stealer | Ensuring Detection and Defense as New Samples Rapidly Emerge. Retrieved August 20, 2024.

    Open source URL
  83. [83]
    objsee mac malware 2017

    Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.

    Open source URL
  84. [84]
    Sofacy Komplex Trojan

    Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use