If you remember the days of downloading risky files from LimeWire, you already understand the psychology behind today’s macOS malware.
Cybercriminals are using deceptive installers that look identical to legitimate software to compromise Apple environments.
For decades, people believed Macs were immune to malware. That myth is completely dead. In 2025, over 65% of newly reported macOS malware were classified as infostealers.
Rather than trying to hide quietly on your system for months, these threats execute a rapid smash-and-grab operation.
They land on your machine, steal your saved passwords, browser cookies, and crypto wallets, and send the data to a remote server before you even realize what happened.
Because they operate so fast, attackers focus all their effort on social engineering the initial installation.
macOS Infostealer Uses DMGs
The infection usually begins in a web browser. Attackers use search engine optimization (SEO) poisoning to push fake software links to the top of search results.
When a user clicks the link, they download what appears to be an authentic installer, typically formatted as a disk image (.dmg) file.
Attackers prefer DMG files over standard package (.pkg) files because packages face strict, rigid security scrutiny from Apple.
When you double-click a DMG, macOS mounts it as a virtual drive. Normally, you just drag the application icon into your Applications folder.
When you open the application, Apple’s Gatekeeper steps in to verify the software is signed by a trusted developer.
To defeat Gatekeeper, attackers trick the human operating the keyboard into bypassing it. When a victim opens a malicious DMG, they are greeted by a polished background graphic with explicit instructions on how to override system security.
According to Huntress research, the ultimate linchpin to an attacker’s success is the end user manually allowing the malware to run.
However, relying solely on user security awareness is a risky defense. Because these attacks are so fast, traditional security tools that wait for a malicious process to execute are often too late.
Modern detection shifts the focus to the exact moment the disk image is mounted, catching the threat before any malware executes.
Defenders use Apple’s Endpoint Security API to monitor virtual mount events and immediately inspect the contents of the disk image.
Scanning the mounted volume for hidden background directories that infostealers commonly use to display fake instructions.
Using optical character recognition to extract text from the background image and comparing it against known malicious phrases.
Scanning filenames and extensions for suspicious instructions or intentional misspellings designed to bypass basic security filters.
As Apple makes traditional attacks like ransomware harder to pull off, cybercriminals will continue targeting the user.
Stopping these deceptive installers at the front door the moment the disk image mounts is the most effective way to prevent your data from being stolen.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
