New 'DOK' Malware targeting MacOS

A new twist on the malware landscape that uses legitimate certificates to thwart the built-in protections of macOS. Once installed, the malware will monitor all network traffic and could steal any data it seems useful..

The whole thing, of course, starts with a phishing email relating to taxes (since all of us in the US just filed ours) that fools you into downloading a zip file..

This cannot be stressed enough. Government agencies (regardless of country) don't send you email with random ZIP files about whatever they are responsible for. So the IRS will not email you about taxes. If they want to contact you, they will use a very official letter sent through USPS and nothing else. So, do not click on any of these emails..

Read more: http://www.mactrast.com/2017/04/new-mac-malware-uses-apple-developer-certificate-infect-machines/

Thanks for the heads up Ashwin.

I read that this morning in my daily "Macworld Review email letter". This one is a real nasty especially if it gets your permission as Ashwin pointed out. It's bad enough I had to pay the IRS this year, so I can't imagine getting "Phished" by malware pretending to be them. Double whammy!

Be careful out there! ;D

It's blocked already. You can test for it. In Terminal, enter this

cat /System/Library/CoreServices/XProtect.bundle/Contents/Resources/XProtect.plist |grep -A1 "OSX.Dok.B"

I got that from an article on how to check your XProtect version:

http://osxdaily.com/2017/05/01/check-xprotect-version-mac/

<Mr. Burns>Excelleeeeent!</Mr. Burns>

Nice. Thank you

Thank you for the information

It's blocked already. You can test for it. In Terminal, enter this

Click to expand...

Thanks Jake. Good stuff.

MacInWin said:

It's blocked already. You can test for it. In Terminal, enter this

cat /System/Library/CoreServices/XProtect.bundle/Contents/Resources/XProtect.plist |grep -A1 "OSX.Dok.B"

I got that from an article on how to check your XProtect version:

http://osxdaily.com/2017/05/01/check-xprotect-version-mac/

Click to expand...

Thanks Jake - so I ran the above in Terminal and received the return shown below, so assume I'm fine? Dave
.

Dave, the fact that the grep returned the string says that you are fine. If it had NOT returned the string name, then your Xprotect would have needed updating.

Raz0rEdge said:

A new twist on the malware landscape that uses legitimate certificates to thwart the built-in protections of macOS. Once installed, the malware will monitor all network traffic and could steal any data it seems useful..

Click to expand...

Apple patched the MacOS against this malware before any of us had even heard of it.

OSX.DOC is a Trojan, not a virus. It arrives attached to an e-mail message. It can be completely avoided by not opening any e-mail attachments called “Dokument.zip”. (Or simply not opening any attachments to any e-mails that you aren't expecting or which don't come from someone you know.)

More importantly:
“Apple has already revoked the certificate used to sign the app, so, at this point, anyone who encounters this malware will be unable to open the app and unable to be infected by it.”
https://blog.malwarebytes.com/threat-analysis/2017/04/new-osx-dok-malware-intercepts-web-traffic/

MacInWin said:

Dave, the fact that the grep returned the string says that you are fine. If it had NOT returned the string name, then your Xprotect would have needed updating.

Click to expand...

Randy B. Singer said:

Apple patched the MacOS against this malware before any of us had even heard of it.

OSX.DOC is a Trojan, not a virus. It arrives attached to an e-mail message. It can be completely avoided by not opening any e-mail attachments called “Dokument.zip”. (Or simply not opening any attachments to any e-mails that you aren't expecting or which don't come from someone you know.)

More importantly:
“Apple has already revoked the certificate used to sign the app, so, at this point, anyone who encounters this malware will be unable to open the app and unable to be infected by it.”
https://blog.malwarebytes.com/threat-analysis/2017/04/new-osx-dok-malware-intercepts-web-traffic/

Click to expand...

Thanks Jake - that was my assumption, especially after Randy's further clarification above. Dave

Thanks everybody, nice to stay abreast of these things.

Yes we have had similar e-mails in UK purporting to come from our equivalent HMRC although none of them has included any attachments. Instead they suggest that the recipient is entitled to a refund etc.

Are you? ?