A malware research team has discovered a new piece of Mac malware that reportedly affects all versions of MacOS and is signed with a valid developer certificate authenticated by Apple (via The Hacker News).
The malware has been dubbed "DOK" and is being disseminated through an email phishing campaign which researchers at CheckPoint say is specifically targeting macOS users, making it the first of its kind.
The malware works by gaining administration privileges in order to install a new root certificate on the user's system. This enables it to gain access to all communications between the host Mac and the internet, including traffic flowing through connections encrypted with SSL.
The initial email pretends to be informing the recipient of inconsistencies in their tax return and asks them to download a zip file attachment to their Mac that harbors the malware. Apple's built-in Gatekeeper security feature reportedly fails to recognize it as a threat because of its valid developer certificate, and the malware copies itself to the /Users/Shared/ folder and creates a login item to make itself persistent, even in a rebooted system.
The malware later presents the user with a security message claiming an update is available for the system, for which a password input is required. Following the "update", the malware gains complete control of admin privileges, adjusts the network settings to divert all outgoing connections through a proxy, and installs additional tools that enable it to perform a man-in-the-middle attack on all traffic.
According to the researchers, Mac antivirus programs have yet to update their databases to detect the DOK malware, and advises that Apple revoke the developer certificate associated with the author immediately.
Back in January, researchers discovered a piece of Mac malware called Fruitfly that successfully spied on computers in medical research centers for years before being detected.
The latest discovery of malware, which appears to target predominantly European users, underlines the fact that Macs are not immune to the threat as is sometimes supposed. As always, users should avoid clicking links or downloading attachments in emails from unknown and untrusted sources.
The malware has been dubbed "DOK" and is being disseminated through an email phishing campaign which researchers at CheckPoint say is specifically targeting macOS users, making it the first of its kind.
The malware works by gaining administration privileges in order to install a new root certificate on the user's system. This enables it to gain access to all communications between the host Mac and the internet, including traffic flowing through connections encrypted with SSL.
The initial email pretends to be informing the recipient of inconsistencies in their tax return and asks them to download a zip file attachment to their Mac that harbors the malware. Apple's built-in Gatekeeper security feature reportedly fails to recognize it as a threat because of its valid developer certificate, and the malware copies itself to the /Users/Shared/ folder and creates a login item to make itself persistent, even in a rebooted system.
The malware later presents the user with a security message claiming an update is available for the system, for which a password input is required. Following the "update", the malware gains complete control of admin privileges, adjusts the network settings to divert all outgoing connections through a proxy, and installs additional tools that enable it to perform a man-in-the-middle attack on all traffic.
According to the researchers, Mac antivirus programs have yet to update their databases to detect the DOK malware, and advises that Apple revoke the developer certificate associated with the author immediately.
Back in January, researchers discovered a piece of Mac malware called Fruitfly that successfully spied on computers in medical research centers for years before being detected.
The latest discovery of malware, which appears to target predominantly European users, underlines the fact that Macs are not immune to the threat as is sometimes supposed. As always, users should avoid clicking links or downloading attachments in emails from unknown and untrusted sources.
Tag: security
74 comments
Apple plans to release the new Mac Pro and the Pro Display XDR on Tuesday, December 10, according to "Save the Date" emails that Apple began sending out to some customers this afternoon.
...
Apple is investigating a popping sound issue with the new 16-inch MacBook Pro and plans to make a fix available in future software updates, the company has indicated in an internal document obtained...
Back in 2004, then-Wired editor Leander Kahney published The Cult of Mac, a photo-filled book containing an array of anecdotes about fans, collectors, and others with special connections to Apple and...
Chicago-based law firm Fegan Scott has levied a lawsuit against both Apple and Samsung, claiming that independent testing suggests the radiofrequency radiation levels in recent smartphones "far...
Apple on December 14 is holding an open house event at Apple Park for Cupertino residents who live near the campus, and has been sending out invites via email to those who are eligible to attend.
...
The widely rumored "iPhone SE 2" might actually be named the iPhone 9, according to an "informed source" cited by Japanese blog Mac Otakara.
The report reiterates that the device...
Apple shares crossed the $269 mark in intraday trading today, setting a new all-time high for the company.
However, oil giant Saudi Aramco is set to overtake Apple as the world's most...
The first three episodes of true-crime drama series "Truth Be Told" are now available to stream on Apple TV+.
New evidence compels true-crime podcaster Poppy Parnell, played by...
