macOS PhantomPulse Plist Persistence

Elgonad .@elgonad

•updated Apr 14, 2026•0•269

Detects the creation of the specific LaunchAgent plist file ('com.vfrfeufhtjpwgray.plist') used by the macOS AppleScript dropper in the REF6598 campaign for persistence, ensuring visibility into the non-Windows infection chain.