A malware research team has discovered a new piece of Mac malware that reportedly affects all versions of MacOS and is signed with a valid developer certificate authenticated by Apple (via The Hacker News).

The malware has been dubbed "DOK" and is being disseminated through an email phishing campaign which researchers at CheckPoint say is specifically targeting macOS users, making it the first of its kind.

Screen Shot 3 3
The malware works by gaining administration privileges in order to install a new root certificate on the user's system. This enables it to gain access to all communications between the host Mac and the internet, including traffic flowing through connections encrypted with SSL.

The initial email pretends to be informing the recipient of inconsistencies in their tax return and asks them to download a zip file attachment to their Mac that harbors the malware. Apple's built-in Gatekeeper security feature reportedly fails to recognize it as a threat because of its valid developer certificate, and the malware copies itself to the /Users/Shared/ folder and creates a login item to make itself persistent, even in a rebooted system.

The malware later presents the user with a security message claiming an update is available for the system, for which a password input is required. Following the "update", the malware gains complete control of admin privileges, adjusts the network settings to divert all outgoing connections through a proxy, and installs additional tools that enable it to perform a man-in-the-middle attack on all traffic.

Screen Shot 2 3
According to the researchers, Mac antivirus programs have yet to update their databases to detect the DOK malware, and advises that Apple revoke the developer certificate associated with the author immediately.

Back in January, researchers discovered a piece of Mac malware called Fruitfly that successfully spied on computers in medical research centers for years before being detected.

The latest discovery of malware, which appears to target predominantly European users, underlines the fact that Macs are not immune to the threat as is sometimes supposed. As always, users should avoid clicking links or downloading attachments in emails from unknown and untrusted sources.

Top Rated Comments

netwalker Avatar
55 months ago
The initial email pretends to be informing the recipient of inconsistencies in their tax return and asks them to download a zip file attachment to their Mac that harbors the malware.
People that actually do this should not have admin rights on their machines.
Score: 25 Votes (Like | Disagree)
darkpaw Avatar
55 months ago
Looking at the screenshot in this story, the spelling mistakes are enough for me to not want to click any further.

I received that email earlier today, but it's to an email address that's not associated with the tax people, so I immediately deleted it.

To avoid all this, I have my own domain and use a separate email for each company/service I interact with, i.e. tesco@mydomain.com, amazon@mydomain.com etc. When I receive spam to a given address, say, tesco@... I change the email for that service to tesco2@... and bin all emails that go to the original. It's a little bit of admin, but it cuts spam down a lot.
Score: 11 Votes (Like | Disagree)
spazzcat Avatar
55 months ago
Wow, more and more reports of malware occurring - need to be even more vigilant


The money quote right here, we as Mac users cannot blindly ignore the threat.
The IRS isn't going to email you zip file about your taxes. If fact no one you don't know is going to email you a zip file that is real.
Score: 7 Votes (Like | Disagree)
justperry Avatar
55 months ago
If People see "OS X Updates available" while on MacOs and still clicking Update All they should think first.

Not only that, always update through the AppStore and you won't get this.
.
.
.
.
.
.
.

Edited: Appsore=Appstore.
Score: 4 Votes (Like | Disagree)
shareef777 Avatar
55 months ago
People that actually do this should not have admin rights on their machines.
Downloading ANY file in an email from someone you don't know is bad. If everyone knew that, then the internet would be a (slightly) safer place.
Score: 4 Votes (Like | Disagree)
newyorksole Avatar
55 months ago
Sooo you're only affected if you click/open suspicious links? Ok I'm safe.

Can't believe people believe these IRS emails/scams...
Score: 3 Votes (Like | Disagree)

Top Stories

Pro Display XDR Yella

Apple Working on External Display With Built-In A13 Chip

Friday July 23, 2021 9:37 am PDT by
Apple is developing an external display that includes an A13 chip with Neural Engine, according to a new rumor from 9to5Mac. The A13 chip with Neural Engine would presumably serve as an eGPU, though details are light at this time. Having a CPU/GPU built into the external display could help Macs deliver high-resolution graphics without using all the resources of the computer's internal chip....
airpods 3 gizmochina Feature

AirPods 3 Rumored to Launch Alongside iPhone 13 at Expected September Event

Friday July 23, 2021 12:54 am PDT by
The third-generation AirPods will likely launch at the same event revealing Apple's upcoming iPhone 13 lineup, according to a report from DigiTimes, which makes the claim citing sources familiar with the matter. The report as a whole echoes previous reporting that production of the third-generation AirPods will kickstart in August, meaning a launch shortly after can be easily expected. DigiTi...
discount m1 macbook yellow

Deals: Shop Record Low Prices Across Apple's Full MacBook Pro and MacBook Air Lineup (Up to $499 Off)

Friday July 23, 2021 8:23 am PDT by
Apple's MacBook Pro and MacBook Air lineup is seeing all-time low discounts across the board today, including the 2019 16-inch MacBook Pro, 2020 13-inch MacBook Air, and 2020 13-inch MacBook Pro. Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running. 13-Inch M1...
iPad mini pro feature

Next iPad Mini Won't Feature Mini-LED Display, Claims Display Analyst

Friday July 23, 2021 8:07 am PDT by
Yesterday, DigiTimes claimed that the upcoming iPad mini will feature a mini-LED display, but now, display analyst Ross Young is going at odds with that report, claiming that while the updated iPad mini continues to be on track for a release this year, it won't feature a mini-LED display. Young says he "confirmed" with Radiant Opto-Electronics, who DigiTimes claims would provide Apple with...
idos 2 app ios

Apple to Pull 'iDOS 2' DOS Emulator From App Store

Thursday July 22, 2021 3:22 pm PDT by
iDOS 2, an app designed to allow users to play classic DOS games, will soon be pulled from the App Store, the app's creator said today. According to iDOS developer Chaoji Li, he tried to submit an iDOS update with bug fixes to the App Store, but was told that the update was rejected because it violated the 2.5.2 App Store guideline that says apps cannot install or launch executable code.Durin...
m1 macbook air

Kuo: Mini-LED MacBook Air Coming in Mid-2022

Thursday July 22, 2021 7:48 pm PDT by
Apple will release a new version of the MacBook Air around the middle of 2022, Apple analyst Ming-Chi Kuo said today in note to investors seen by MacRumors. The upcoming MacBook Air will feature a 13.3-inch mini-LED display, which would make it the second Mac to gain mini-LED technology after the 2021 MacBook Pro, which is rumored to include a mini-LED display and is expected to launch later ...
iphone12cameras

iPhone Helps to Identify Rare Form of Cancer

Friday July 23, 2021 4:00 am PDT by
A photo taken on an iPhone has helped to identify a rare form of cancer, according to news reports. A mother of three from Gainesville, Florida took a photo of her three-month-old son using her iPhone and its True Tone flash, which highlighted an abnormality in his right eye. The boy's mother, a labor and delivery nurse, recalled learning about retinoblastoma during her training....
iphone 13 blue with text

iPhone 13 May Support 25W Fast Charge Power Adapter

Friday July 23, 2021 2:52 am PDT by
The iPhone 13 may support faster-charging speeds with a 25W power adapter, compared to the current limitation of the iPhone 12, which only supports fast charging at up to 20W, according to a rumor originating from China. The iPhone 12 supports fast charging with a 20W or higher power adapter; however, even if users use a more powerful wall adapter, the iPhone itself only supports up to 20W....
iPad mini pro feature

Next-Generation iPad Mini Will Reportedly Feature a Mini-LED Display

Thursday July 22, 2021 9:03 am PDT by
Apple is widely rumored to be planning a new iPad mini with a significant redesign, including a larger 8.5-inch to 9-inch display with slimmer bezels, a Touch ID power button instead of a home button, a USB-C port instead of a Lightning connector, and more. According to a paywalled preview of a DigiTimes report today, the sixth-generation iPad mini will also feature a mini-LED display:BLU...
magsafe battery pack iphone 12 mini

Top Stories: Hands-On With MagSafe Battery Pack, iPhone 13 Always-On Display?

Saturday July 24, 2021 6:00 am PDT by
Apple's new MagSafe Battery Pack is now available, and we went hands-on this week for some early impressions of the new accessory to get more battery life out of Apple's iPhone 12 lineup. Subscribe to the MacRumors YouTube channel for more videos. This week also saw a number of rumors about the upcoming redesigned MacBook Pro models, the iPhone 13 lineup, the next-generation iPad mini, a new...