REF6598 macOS Plist Creation - PHANTOMPULSE RAT

Rachid O@mrrachid

•updated May 12, 2026•0•212

Detects the creation of the specific LaunchAgent plist file (com.vfrfeufhtjpwgray.plist) used by the macOS execution chain for persistence in the REF6598 campaign delivering PHANTOMPULSE RAT.