Deep Persistence & Control Surfaces

Hunt for DYLD_INSERT_LIBRARIES injection — a set variable that forces a library to load into other programs, a classic code-injection and persistence technique. Checks launch items, your shell config, and the live environment. A finding you didn't set deliberately means a library is running inside your apps.

Check for a legacy login or logout hook — a deprecated mechanism that runs a script automatically at every login or logout, which malware abuses for persistence because it survives most reinstalls.

List the scripts macOS runs on a daily, weekly or monthly schedule, flagging any not owned by the system — a user-writable periodic script is a persistence red flag. Most entries are Apple's own maintenance jobs.

List one-shot jobs queued to run once at a future time. This scheduler is rarely used deliberately on a Mac, so a queued job you didn't create is worth a look.

List third-party QuickLook plugins — code that runs when you press Space to preview a file in Finder, a real if uncommon execution surface. Verify any you don't recognise before trusting it.

List third-party Spotlight importers — code that runs when Spotlight indexes a file of their type, an execution surface most people never check. Many are legitimate, from apps like office suites and design tools.

List Folder Actions — scripts attached to run automatically when a folder's contents change, a persistence and automation vector. A folder action you didn't set up yourself is suspicious.

Report whether this Mac is under device-management control and which settings an organisation is enforcing. Normal on a work or school Mac; on a personal Mac you didn't enrol, a managed profile can be a sign of supervision or spyware.

Audit the SSH server configuration for hardening — flagging remote root login and password authentication, the two weak settings. Reads configuration keys only, never a key or password, and only matters when Remote Login is on.

Report whether Remote Apple Events is on — a setting that lets other Macs on the network send this one scripting commands to control it remotely. Unless you specifically use it, it can be turned off.

Inventory your keychain by item type — counts of app and website passwords, keys, and certificates. This is counts only: Cyclone never requests, reads, or displays any actual password or key.

Report whether a firmware password is set on an Intel Mac — it stops someone booting from another disk or entering Recovery without it. On Apple Silicon it reports honestly that there is no such feature, because that platform protects startup a different way.

Remove a legacy login or logout hook so no script runs at login or logout via that old mechanism — the fix when one is found. Needs admin.

Dequeue a one-shot scheduled job so it won't run — the fix for a suspicious queued job. Acts only on your own queue.

Turn off Remote Apple Events so other Macs can no longer send this one scripting commands to control it remotely. Needs admin.

Delete a user-installed QuickLook plugin and reset QuickLook so it stops running when you preview files — the fix for an unrecognised plugin. Acts only on your own plugins; system ones are left alone.