Malicious LaunchAgents on macOS: Detection, Investigation, and Fleet Removal for Security Teams

macOS has four relevant persistence directories:

• ~/Library/LaunchAgents/: User-level agents. Run as the logged-in user at login. No administrator privileges required to install. This is where most malware persists.
• /Library/LaunchAgents/: System-wide agents that run as the logged-in user. Requires admin/root to write.
• /Library/LaunchDaemons/: System-wide daemons that run as root. Requires admin/root to write. Higher privilege but requires more access to install.
• /System/Library/LaunchDaemons/: Apple system services. Should never contain third-party entries.

A LaunchAgent plist file has a minimum of two keys:

• Label: A reverse-domain identifier (e.g., com.user.gh-token-monitor)
• ProgramArguments: The command to run

Optional but common:

• RunAtLoad: true, run immediately when loaded (at login)
• StartInterval: N, run every N seconds
• KeepAlive: true, restart if the process exits

osquery provides a standardized way to query system state across your macOS fleet. If you have osquery deployed (standalone or via tools like Fleet, Kolide, or Jamf Pro with osquery integration), run this query against all your macOS endpoints:

SELECT
  path,
  name,
  label,
  program,
  program_arguments,
  run_at_load,
  keep_alive,
  start_interval
FROM launchd
WHERE
  path LIKE '/Users/%/Library/LaunchAgents/%'
  OR path LIKE '/Library/LaunchAgents/%'
ORDER BY path;

This returns every LaunchAgent across all user profiles on the machine. For a fleet of 50+ machines, run this via osquery's distributed query feature and export the results to a spreadsheet.

For machines without osquery, use a shell script deployed via Jamf or Ansible:

find ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons \
  -name '*.plist' 2>/dev/null | while read f; do
  echo "=== $f ==="
  /usr/libexec/PlistBuddy -c 'Print :Label' "$f" 2>/dev/null
  /usr/libexec/PlistBuddy -c 'Print :ProgramArguments' "$f" 2>/dev/null
done

A typical developer machine has between 20 and 60 LaunchAgents. Most are legitimate. Distinguish them by checking these attributes:

Publisher verification: Legitimate LaunchAgents from major software vendors (Adobe, Dropbox, Zoom, Microsoft) have consistent naming patterns (e.g., com.adobe., com.microsoft.). An entry with a generic label like com.user.* or com.apple.* in the user LaunchAgents directory (~/Library/LaunchAgents/) is suspicious, Apple's own services are in /System/Library/, not the user directory.

Executable path: Check the ProgramArguments key. Legitimate agents point to executables in /Applications/, /usr/local/bin/, or other standard locations. An agent pointing to a binary in ~/Library/Application Support/ with a non-descriptive name, or to a shell script in a temp directory, is a red flag.

Code signing: Check whether the executable is signed by Apple or a verified developer:

codesign -dv /path/to/executable 2>&1

Look for Authority= lines. An unsigned executable or one signed by a developer certificate with an unfamiliar name warrants investigation.

Installation time: The plist file's modification time indicates when it was installed. An entry that appeared recently (within the last 30 days) and was not associated with a software installation you remember is suspicious.

When you find a suspicious entry, do not remove it yet, investigate first to understand the scope.

Read the full plist:

cat ~/Library/LaunchAgents/com.user.gh-token-monitor.plist

Check when it was installed and by what process:

mdls ~/Library/LaunchAgents/com.user.gh-token-monitor.plist
# Look for kMDItemDateAdded

Correlate the installation time with your shell history, what did you run around that time?

grep -h '' ~/.zsh_history | grep -B5 -A5 'npm install'

Examine the executable it runs:

# Get the executable path from the plist
EXEC=$(/usr/libexec/PlistBuddy -c 'Print :ProgramArguments:0' \
  ~/Library/LaunchAgents/com.user.gh-token-monitor.plist)

# Check file type and hash
file "$EXEC"
sha256sum "$EXEC"

Submit the hash to VirusTotal or compare against known IOCs from the relevant security advisory.

Check network activity of the running process: If the LaunchAgent is currently running:

lsof -i -n -P | grep $(pgrep -f gh-token-monitor)

This shows current network connections, revealing the C2 server the malware is communicating with.

Once you have confirmed a malicious LaunchAgent label, remove it across your fleet before the attackers know you are aware.

For immediate removal via Jamf: Create a Jamf policy with a shell script payload:

#!/bin/bash
AGENT="$HOME/Library/LaunchAgents/com.user.gh-token-monitor.plist"
if [ -f "$AGENT" ]; then
  launchctl unload "$AGENT" 2>/dev/null
  rm -f "$AGENT"
  echo "Removed malicious LaunchAgent"
  logger -t security "Malicious LaunchAgent removed: $AGENT"
else
  echo "LaunchAgent not found"
fi

Set the policy scope to All Computers and trigger it as a self-service policy with immediate execution, or trigger via API for instant fleet-wide deployment.

For manual removal on a single machine:

launchctl unload ~/Library/LaunchAgents/com.user.gh-token-monitor.plist
rm ~/Library/LaunchAgents/com.user.gh-token-monitor.plist

Also check for the associated executable and remove it:

rm ~/Library/Application\ Support/com.user.gh-token-monitor  # or whatever path the plist referenced

Add a scheduled osquery query to your fleet that runs every 6 hours and alerts on any new user LaunchAgent not in your approved baseline:

{
  "schedule": {
    "new_launch_agents": {
      "query": "SELECT path, label, program_arguments FROM launchd WHERE path LIKE '/Users/%/Library/LaunchAgents/%';",
      "interval": 21600,
      "description": "Detect new user LaunchAgents for persistence monitoring"
    }
  }
}

Pair this with a differential check, alert only on entries that did not exist in the previous run. Integrate the output with your SIEM or send to Slack/Teams via osquery's logger plugin.

For a faster check without osquery, deploy a Launch Constraint configuration via MDM that restricts which executables can be loaded as LaunchAgents, this is a macOS 13+ feature that blocks unsigned or unknown binaries from persisting via the LaunchAgent mechanism.