macOS ClickFix - Silent DMG Mount via hdiutil Without User Interaction

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•3

This rule detects the execution of 'hdiutil' to attach a disk image with the '-nobrowse' flag, initiated by various scripting interpreters (bash, zsh, python, etc.) or terminal applications. This pattern is frequently used by adversaries to silently mount malicious payloads or tools contained within disk images while bypassing user interaction.