Security researchers have identified a widespread macOS malware campaign that employs a loader disguised as cracked music plugin DMG files to deliver a series of malware, including notable variants such as Odyssey and MacSyncStealer. These DMG files are primarily distributed through social engineering tactics, convincing users to install them despite being unsigned. Within these malicious DMGs, a specific configuration file, Installer.plist, has been found embedded in over 100 instances. This property list serves as a hidden script that facilitates communication between the malware and a remote server at http://mac.fleebottom-33.xyz. It is programmed to send tracking IDs specific to the campaign and retrieve further malicious payloads of instructions without alerting the user.