Weaponized DMG Installers Spread macOS Infostealers Including AMOS

Threat actors are increasingly using weaponized .dmg files disguised as legitimate macOS software installers to deliver infostealer malware, with campaigns relying heavily on social engineering to convince users to bypass Apple Gatekeeper and other trust prompts. Researchers said the malware typically focuses on rapid collection and exfiltration rather than persistence, stealing browser credentials, cookies, authentication tokens, Apple Keychain data, macOS passwords, and cryptocurrency wallet information from infected systems.

Multiple macOS stealer families have been tied to the tactic, including Atomic macOS Stealer (AMOS), Poseidon, Odyssey, and MacSync. AMOS in particular has been marketed as malware-as-a-service and distributed through malvertising, SEO poisoning, fake download pages, social media ads, GitHub-hosted binaries, open directories, poisoned search results, and piracy forums while impersonating popular apps such as Notion, Trello, Arc, Slack, Todoist, and CleanMyMac X. Defenders were urged to monitor suspicious DMG mount activity in /Volumes, inspect hidden .background directories, use OCR on installer graphics, unmount suspicious disk images quickly, and restrict software installation to legitimate, Apple-verified sources outside unofficial or cracked-software channels.