macOS Stealer - Hidden Shell Script via DMG Mount

Ibrahim Saud@tektrix

•updated Jun 22, 2026•1•0•10

Detects a user mounting a deceptive .dmg file that invokes a hidden .sh or .command script upon opening. This rule specifically looks for the 'hdiutil' process attaching a disk image and then correlates it with a process executing a hidden shell script (.sh or .command) from a mounted volume.