Terms

Adversaries may establish persistence by executing malicious content triggered by the execution of tainted binaries. Mach O binaries have a series of headers that are used to perform certain operations when a binary is loaded. The LC LOAD DYLIB header in a Mach O binary tells macOS and OS X which dynamic libraries (dylibs) to load during execution time. These can be added ad hoc to the compiled binary as long as adjustments are made to the rest of the fields and dependencies.(Citation: Writing Bad Malware for OSX) There are tools available to perform these changes.