There are multiple places where malware can hide from the user on the macOS system. Here are some of the most common locations:
- /tmp: The most popular location to put intermediate files, as malware can be sure it will have write access there with pretty much any standard privileges.
- /Library/ and ~/Library: Another location misused by malware aiming to look benign and hide between legitimate apps. The Application Support subdirect
- ory is commonly used here as well.
- ~/Library/Safari/Extensions: This location is gene
- rally used to install unwanted browser extensions for Safari.
- ~/Library/Application Support/Google/Chrome/Default/Extensions: Here, unwanted browser extensions are installed for Chrome.
Persistence is commonly achieved by adding the corresponding .plist file to one of the following locations:
- /Library/LaunchDaemons: A system-wide daemons provided by the administrator; can start without a user logged in
- /Library/LaunchAgents: Per-user agents provided by the administrator...
