~/Library/LaunchAgents/com.user.update.plist

Posts referencing this indicator

• Intelligence Center

  CCisco Talos

  Malicious LaunchAgent plist used for persistence to extract and execute payloads from Finder comments at login.

  2026-05-13