file_path
~/Library/LaunchAgents/com.system.notifications.agent.plist
discovered 2026-07-22
Persistence LaunchAgent (label com.system.notifications.agent, StartInterval 60s) that polls /v1/agent/ping on the C2 host every 60 seconds for follow-on commands.
