Outer Web | Explore

/explore

Click through on any links that interest you or select the planets on the right to continue exploring the Outer Web.

You are here		objective-see.com Objective-See's Blog
\|	\|	bradleyjkemp.dev LaunchDaemon Hijacking: privilege escalation and persistence via insecure folder permissions \| bradleyjkemp	3.1 parsecs away Travel
\|	\|	LaunchDaemon (or LaunchAgent) Hijacking is a MacOS privilege escalation and persistence technique. It involves abusing insecure file/folder permissions to replace legitimately installed, misconfigured LaunchDaemons with malicious code. I first spotted this issue affecting the OSQuery installer but went looking and found multiple other products with the same problem. This isn't a novel technique (it's briefly mentioned in T1543.004) but I was surprised to find it so rarely talked about. Example - Hijacking the OSQuery LaunchDaemon I've already disclosed this issue to the OSQuery team and they kindly let me use it as an example in this post.	3.1 parsecs away Travel
\|	\|	objective-see.org Objective-See's Blog	0.2 parsecs away Travel
\|	\|	[AI summary] This post provides a technical analysis of OSX.DazzleSpy, a cyber-espionage macOS implant used to target pro-democracy users in Hong Kong, detailing its persistence mechanisms, remote capabilities, and detection by Objective-See's tools.	0.2 parsecs away Travel
\|	\|	balintmagyar.com Client-side RCE via Symlink Following in Google Web Designer for macOS/Linux: CVE-2025-1079 - Bálint Magyar	3.8 parsecs away Travel
\|	\|	Fixed in version 16.2.0.0128 - $11,250 bug bounty	3.8 parsecs away Travel
\|	\|	blaster.ai Instant offline emails on Mac with goimapnotify, mbsync and mu \| Blaster.ai	8.8 parsecs away Travel
\|		Helping e-commerce startups grow	8.8 parsecs away Travel