Avoid third‑party sites offering standalone AC2 DMGs unless you can independently verify them—these are a common supply‑chain risk.
