Weaponized DMG Files Target macOS Users with Infostealer Malware

Key Takeaways

• Threat actors are actively leveraging weaponized DMG files to distribute infostealer malware, specifically targeting macOS users.
• These attacks rely heavily on social engineering through fake software installers, designed to bypass Apple’s built-in security mechanisms.
• The infostealers are designed for rapid data exfiltration, collecting credentials, browser data, authentication tokens, and cryptocurrency wallet information without establishing persistence.
• Over 65% of new macOS malware in 2025 was classified as infostealers, indicating a significant shift in threat actor focus towards Apple environments.
• Effective detection requires proactive monitoring at the disk image mounting stage, rather than waiting for malware execution.

Cybersecurity researchers have identified a troubling surge in attacks against macOS users, with threat actors deploying weaponized Disk Image (DMG) files to deliver potent infostealer malware. This sophisticated tactic directly challenges the long-held perception that Apple’s operating system offers inherent immunity to cyber threats, underscoring a significant evolution in the threat landscape.

These campaigns are characterized by their rapid execution and reliance on deceptive software installers. Attackers meticulously craft these fake installers to mimic legitimate applications, effectively tricking users into granting access and bypassing critical security prompts without suspicion. The speed and effectiveness of these operations position them among the most urgent threats currently facing Mac users.

For decades, many macOS users operated under the assumption that their systems were secure by default. This premise is increasingly outdated. In 2025 alone, infostealers accounted for more than 65% of newly reported macOS malware, signaling that threat actors now view Apple environments as high-value targets. The objective is clear: harvest sensitive data including credentials, browser cookies, authentication tokens, and cryptocurrency wallet information.

The “Smash-and-Grab” Infostealer Approach

A distinguishing feature of these infostealers is their swift operational tempo. Unlike traditional malware that seeks to establish persistence on a system through reboots, these threats forgo such mechanisms entirely. Instead, they execute a “smash-and-grab” operation, rapidly exfiltrating sensitive data to a remote server before the victim can detect the compromise.

Analysts at Huntress detailed this pattern in a report shared with Cyber Security News (CSN), highlighting that attackers have almost entirely shifted their focus to social engineering the initial installation phase. Because the malware does not need to persist, the critical vulnerability lies in this first interaction. Attackers heavily invest in making their fake installers indistinguishable from genuine ones, complete with authentic branding and explicit instructions designed to guide users past Apple’s native security features.

Weaponized DMG Files: A Preferred Delivery Method

The deliberate choice of DMG as a delivery format is strategic. Compared to package (.pkg) files, disk images are subject to less rigorous signing requirements and face reduced scrutiny from macOS security checks. When a user double-clicks a DMG, macOS mounts it as a virtual drive in the /Volumes directory, initially isolating its contents. However, this isolation becomes irrelevant once the attacker successfully manipulates the user into cooperating with the malicious installation.

A standard, legitimate DMG file typically presents a clear “drag-to-Applications” prompt. Malicious counterparts appear identical but embed instructions within the background image of the folder window, instructing users on how to override Gatekeeper, Apple’s built-in mechanism for verifying trusted software. These subtle, embedded instructions are often overlooked as suspicious by unsuspecting users. This technique has been observed across several infostealer families, including AMOS, Poseidon, Odyssey, and MacSync.

Attackers have also developed variations of this social engineering approach. In some instances, bypass instructions are directly encoded into the filename itself, such as “Drag to Terminal.” Furthermore, piracy websites frequently distribute “cracked” software, conditioning users to disregard security warnings as normal behavior associated with installing unofficial applications.

What You Should Do

• Exercise Extreme Caution with Downloads: Only download software from official vendor websites or the Apple App Store. Avoid third-party sites, torrents, or unofficial forums, especially those offering “cracked” or free versions of paid software.
• Scrutinize Installer Prompts: Be highly suspicious of any installer that instructs you to drag a file to the Terminal, modify System Settings to allow “unknown” software, or disable security features like Gatekeeper. Legitimate applications rarely require such manual overrides.
• Enhance Security Awareness: Educate yourself and your team about common social engineering tactics. Understand that even on macOS, vigilance is paramount.
• Implement Endpoint Detection and Response (EDR): Utilize advanced EDR solutions capable of monitoring disk image mounting events and analyzing installer graphics for suspicious instructions, rather than solely relying on post-execution detection.
• Regularly Back Up Data: Maintain frequent backups of critical data to an offline or cloud storage solution to mitigate the impact of data exfiltration.
• Enable Multi-Factor Authentication (MFA): Implement MFA wherever possible, especially for email, cloud services, and financial accounts. This adds a crucial layer of security even if credentials are stolen.
• Keep Software Updated: Ensure your macOS operating system and all applications are kept up to date to benefit from the latest security patches.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.