Selected project

macOS malware incident response.

A rushed developer-tool install turned into a defensive investigation of fake Apple-looking LaunchDaemons, hidden payload paths, root-owned processes, ad-hoc signed Mach-O binaries, and possible stealer or clipboard-hijacker indicators.

Role: Incident responder and evidence author
Stack: macOS, launchd, plutil, codesign
Contribution: Triage, static analysis, quarantine, verification
Outcome: Persistence removed and documented

Evidence page showing macOS persistence trojan classification, static-analysis approach, shell-script behavior, binary indicators, code signing, and wallet-address patterns

Preserved evidence before cleanup

Suspicious LaunchDaemon files, hidden scripts, binary paths, code-signing output, hashes, and strings were documented before destructive cleanup actions were taken.

Confirmed persistence behavior

The strongest signal was not the Apple-like labels alone. It was those labels pointing to hidden payloads inside user-writable home-directory locations.

Kept analysis static

The payloads were not executed again. The investigation used plist parsing, shell-script review, process-path inspection, code-signing metadata, SHA-256 hashing, and strings extraction.

Verified persistence was gone

After quarantine, unloading, cleanup, process termination, and reboot, the fake LaunchDaemon labels did not reload and no root-owned payload process remained under the home directory.

Incident evidence

A portfolio-ready report built from preserved artifacts.

The evidence report shows the investigation path: persistence mechanism, malware classification, static dissection, containment, cleanup, and post-reboot verification. It is presented as a defensive security workflow, not as malware execution guidance.

Evidence page showing fake LaunchDaemon labels, preserved plist behavior, RunAtLoad, KeepAlive, and hidden payload paths — Persistence evidence showing fake Apple-looking LaunchDaemon labels and hidden payload paths started through RunAtLoad and KeepAlive. Open full-size

Evidence page showing static analysis methods, shell-script behavior, Mach-O binary indicators, ad-hoc signatures, and wallet-address strings — Static dissection summary covering shell loops, Mach-O binaries, ad-hoc code signatures, and indicator strings used for risk classification. Open full-size

Evidence page showing quarantine folder, preserved items, cleanup actions, post-reboot verification, clean crontabs, and lessons learned — Containment and verification evidence showing quarantine, unloaded LaunchDaemons, process cleanup, reboot checks, clean crontabs, and final Malwarebytes result. Open full-size

Evidence report

The full DOCX report is attached as a portfolio artifact.

The report keeps the incident narrative tied to concrete artifacts: fake LaunchDaemon labels, hidden payload locations, static-analysis signals, containment sequence, and post-cleanup verification. The public page summarizes the workflow; the DOCX preserves the evidence-led writeup.

Download DOCX evidence report

Response workflow

From suspicious install to verified cleanup.

Identify persistenceInspect LaunchDaemon labels, program arguments, RunAtLoad, and KeepAlive behavior.
Map payloadsTrace plist entries to hidden scripts and binaries under user-writable paths.
Preserve indicatorsRecord file type, code-signing metadata, hashes, process paths, and strings output.
Contain carefullyQuarantine suspicious files first, then unload services and remove malicious plist entries.
Verify after rebootCheck launchd reload behavior, running processes, crontabs, and scanner results.