📰 5 months of undetected JXA backdoor on macOS. signature scanners found nothing, manual persistence check found it in 10 seconds

Background: developer, cybersecurity basics but not a security professional. Working on a M Chip Mac. Posting as a writeup and to sanity-check my analysis and response. Discovery Auditing login items in ~/Library/LaunchAgents/. Normally vendor-named (com.google.keystone.agent), but one entry was a bare 32-character hex string pointing to a JS file...