A recent surge in macOS-targeted campaigns shows threat actors favoring weaponized disk images (.dmg) as the primary delivery mechanism for infostealer malware.
Attackers are leveraging convincing, branded DMG installers and social-engineering tricks to bypass Gatekeeper and trick users into executing payloads that rapidly harvest credentials, cookies, authentication tokens, and cryptocurrency wallets before disappearing without persistence.
The infection chain begins with SEO-poisoned search results, compromised torrent sites, and cracked-software forums that host forged download links.
Victims who believe they are installing legitimate paid software instead mount a DMG that presents a polished Finder window with a custom background image or misleading filenames instructing the user how to “open” the app.
These instructions deliberately teach the user to override Gatekeeper through right-click open flows, dragging the app into Terminal, or following System Settings prompts so the malware can run despite Apple’s notarization checks.
Attackers prefer DMGs over .pkg installers because DMGs are simpler to craft and require less formal signing and developer infrastructure, while presenting fewer technical hurdles for social engineering.
When mounted, a DMG appears in /Volumes and can show an embedded background (.background) graphic that visually convinces users to take insecure actions.
This approach enables a “smash-and-grab” design: the infostealer executes immediately, extracts high-value secrets and session artifacts, and exfiltrates data to a command-and-control (C2) server without needing persistence across reboots.
Huntress said in a report shared with GBhackers, 2025 telemetry and industry reports indicate infostealers now represent a majority of new macOS threats, with many families (AMOS, Poseidon, Odyssey, MacSync and others).
Reusing the same patterns of background-image guidance, filename-encoded instructions like “Drag to Terminal,” and distribution via piracy-marked releases (TNT, CRACKED).
Operators use minor obfuscation misspellings, renamed binaries, and legitimate-looking icons to increase the chance a user follows bypass instructions.
Defenders can close this attack window by shifting detection to the mount event. macOS’s Endpoint Security API emits mount notifications when virtual volumes appear under /Volumes, allowing modern agents to differentiate VIRTUAL mounts (disk images) from network shares and external disks.
Effective detection workflows inspect mounted volumes for .background folders, run OCR on embedded images using frameworks such as Apple’s Vision, and scan filenames and extensions for suspicious patterns (e.g., .scpt AppleScripts or “Drag to Terminal” text).
Fuzzy-matching helps catch intentional misspellings intended to evade simple signatures.
When a deceptive installer is confirmed, containment should start by unmounting the volume and terminating related processes.
Incident responders must then check for rapid exfiltration indicators and common infostealer behaviors: ephemeral scripts, requests for keychain access, browser profile and cookie extraction, and unusual outbound connections to known C2 infrastructure.
Organizations with 24/7 SOC capabilities can accelerate triage and remediation by correlating mount-time telemetry with network logs and endpoint process traces.
End-user education remains critical: treat unsolicited downloads and “cracked” software as high risk, avoid following on-screen installer instructions that ask for manual Gatekeeper overrides, and verify software sources.
Meanwhile, security teams should instrument endpoint agents to monitor ES mount events, perform content analysis on mounted volumes, and escalate suspicious mounts before a payload executes.
As Apple hardens its platform, attackers will continue to exploit human trust; catching deceptive installers at mount time offers the most reliable opportunity to prevent a fast-moving infostealer from completing its mission.
Further reading: Objective-See’s macOS threat analyses, Huntress research on deceptive installers and Endpoint Security API documentation provide technical details and detection examples for defenders tracking these campaigns.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…