This technique can be used to hide a newly-created user from the configuration and login screens. The idea here is to set a property Hide500Users in the /Library/Preferences/com.apple.loginwindow.plist file. In this case, all users with a uid lower than 500 won't be present in the these screens. An example of a threat utilizing this technique to hide an illegitimate user is Pirrit.
United States
United Kingdom
India
Germany
France
Canada
Russia
Spain
Brazil
Australia
Argentina
Austria
Belgium
Bulgaria
Chile
Colombia
Cyprus
Czechia
Denmark
Ecuador
Egypt
Estonia
Finland
Greece
Hungary
Indonesia
Ireland
Italy
Japan
Latvia
Lithuania
Luxembourg
Malaysia
Malta
Mexico
Netherlands
New Zealand
Norway
Philippines
Poland
Portugal
Romania
Singapore
Slovakia
Slovenia
South Africa
South Korea
Sweden
Switzerland
Taiwan
Thailand
Turkey
Ukraine