# macOS Finder Sync abused for persistence

Published: 2026-08-02 · Severity: low · Sectors: technology
Canonical: https://vorant.io/reports/c5227259-0630-5ba1-8545-878ab6c78f6a/macos-finder-sync-abused-for-persistence

> Researchers show macOS malware can abuse Finder Sync extensions and pluginkit to achieve stealthy, automatic persistence at login.

This Objective-See research post explores how macOS's Finder Sync extension mechanism, intended to let apps like Google Drive or Dropbox integrate with Finder.app, can be abused by malware for persistence. Because Finder Sync bundles are automatically registered and loaded by the pkd (PluginKit daemon) launch agent, and because a constructor function can be embedded to execute code as soon as the bundle loads, an attacker can install a malicious Finder Sync via the pluginkit command-line utility without needing a wrapper application or external plist. This gives malware a way to be reliably re-executed every time the system starts and the user logs in.

The author notes that while Finder Syncs must be sandboxed and code-signed to be accepted by the OS, this is not necessarily a strong barrier — pointing to real macOS malware families such as Janicab and Piritt that carried valid Apple developer ID signatures. A malicious extension could also request broad file-system access via temporary-exception entitlements, and could disguise itself with an innocuous name (e.g., mimicking Dropbox or Google Drive) since the System Preferences UI does not show path or signing details.

To address detection gaps, the author updated their KnockKnock tool to enumerate and display all installed and activated extensions, including Finder Syncs, along with path, packing status, and VirusTotal detection ratio, enabling analysts to spot suspicious plugins. The piece is a defensive research/technique disclosure rather than a report of an active, in-the-wild campaign.

## Mentioned in this report

- Malware: Janicab, Piritt

Source reporting: https://objective-see.org/blog/blog_0x11.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/c5227259-0630-5ba1-8545-878ab6c78f6a/macos-finder-sync-abused-for-persistence.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup