v1v3km wrote:
Hi Guillaume! The DMG file path you're seeing is from Apple's MobileAsset framework — specifically the "IF_Planner" (Interface Planner/Routing) component used in macOS for iOS firmware delivery and update staging. These are legitimate system disk images, not malware.
Here's what's happening and how to address it:
1. Why it happens:
- macOS Sequoia uses this MobileAsset path to stage iPhone/iPad firmware-related assets
- The repeated mounting suggests a background process (likely AssetCacheManagerd or softwareupdated) keeps re-triggering the mount
2. Check if a software update is pending:
- Go to System Settings → General → Software Update
- If an update is available, install it — the mounting often stops once the associated asset download completes
3. Clear the asset cache:
- Open Terminal and run: sudo AssetCacheManagerUtil flushCache
- This forces the cache to purge staged assets and can stop the repeated mounts
4. Disable automatic background downloads temporarily:
- Go to System Settings → General → Software Update → Automatic Updates
- Toggle off "Download new updates when available" temporarily
- Restart your Mac
- This prevents background asset staging until you re-enable it
5. Check Login Items and Background agents:
- System Settings → General → Login Items & Extensions
- Look for any unfamiliar items related to MobileAsset or AssetCache and disable them
This is almost certainly a benign macOS background task, not a virus or security issue. After completing any pending update, the disk images should stop remounting. Hope this clears it up!
I agree that the DMG itself is almost certainly a legitimate Apple system asset, so there is no reason to suspect malware based on the path alone. However, I think the rest of that explanation goes beyond what can actually be supported.
The description of the file as an "Interface Planner/Routing component used for iOS firmware delivery" is not something Apple has publicly documented. It appears to be an educated guess rather than a verified explanation of what that specific MobileAsset does.
I also would not assume that repeated mounting is being caused by AssetCacheManager or the Content Caching service.
There is no evidence that those services are responsible for this type of behavior on a standard Mac. Several other Apple system processes, including mobileassetd, assetd, cryptexd, or softwareupdated, could potentially be involved. Without identifying which process is actually mounting the image, attributing it to a specific daemon is speculative.
The recommendation to run sudo AssetCacheManagerUtil flushCache is also questionable.
That utility is intended to manage Apple's Content Caching service, not to clear MobileAsset downloads or resolve repeatedly mounted Cryptex disk images.
Likewise, disabling automatic software update downloads is not a known fix for this issue and could simply delay future security updates without addressing the root cause.
The suggestion to check Login Items for MobileAsset or AssetCache is also misleading. Those are Apple system services that do not normally appear as user-manageable login items or background extensions.
A more reliable approach would be to determine which process is repeatedly mounting the DMG by using tools such as lsof, mount, diskutil, or Activity Monitor.
That provides actual evidence instead of relying on assumptions. If the behavior continues even when there are no software updates in progress and no connected Apple devices requiring firmware assets, then it is entirely possible that this is a bug in macOS 15.7.7 rather than expected behavior.
In short, the conclusion that the DMG is a legitimate Apple component is reasonable. The explanation for why it keeps mounting and the proposed fixes, however, are largely speculative and are not supported by publicly available Apple documentation.
