Weaponized DMG Files Target macOS Users with Infostealer Malware

• •Over 65% of new macOS malware in 2025 was infostealers, targeting user credentials.
• •Attackers use weaponized DMG files disguised as legitimate software to deceive users.
• •The infection process often begins with SEO poisoning and compromised torrent links.

Hackers are exploiting macOS users through weaponized DMG files that masquerade as legitimate software installers. This tactic leverages the misconception that Apple devices are immune to malware, allowing attackers to harvest sensitive information quickly. In 2025, over 65% of newly reported macOS malware was classified as infostealers, indicating a significant rise in credential and data theft targeting Apple environments. The attacks primarily initiate via web browsers, utilizing SEO poisoning and compromised links in torrent networks. The infostealers operate rapidly, exfiltrating data before detection, without establishing persistence on the infected systems. This trend highlights a shift in focus from traditional malware tactics to social engineering for initial installation. Current reports indicate that these attacks are ongoing and increasingly sophisticated.