Each user on a Mac can have a LaunchAgents folder in their own Library folder to specify code that should be run every time that user logs in. We can confirm this is the case with Green Lambert by running the implant, then checking the user’s LaunchAgents folder