Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
4/7/2017
12:30 PM
Thomas Reed
Thomas Reed
Partner Perspectives
Connect Directly
Twitter
RSS
50%
50%

OSX.Dok: New & Sophisticated Mac Malware Strikes

Phishing-deployed malware can capture account credentials for any website users log into.

A surprisingly sophisticated new piece of Mac malware, called OSX.Dok, uses sophisticated means to monitor—and potentially alter—all HTTP and HTTPS traffic to and from the infected Mac. This means that the malware is capable, for example, of capturing account credentials for any website users log into, which offers many opportunities for theft of cash and data.

The malware was discovered by Check Point, in the form of a file named Dokument.zip, which was found being emailed to victims in phishing emails. Victims primarily have been located in Europe.

This “document” is, of course, actually an application. The app will obscure the entire screen with a fake update notification.

Image Source: Malwarebytes
Image Source: Malwarebytes

If the user clicks Update All and provides an admin password, the malware will finish installing, though it will take some time.

Among other things, two files will be installed in the user’s LaunchAgents folder to redirect this traffic. These are named com.apple.Safari.pac.plist and com.apple.Safari.proxy.plist. These files will help the malware redirect all web traffic through a malicious proxy server.

Once all this is complete, the malware deletes itself, leaving behind few obvious signs of its presence beyond the two deceptively-named launch agents.

Removal
Removing the two aforementioned LaunchAgents files is sufficient to disable the malware, but there are many leftovers and modifications to the system that cannot be as easily reversed, including:

  • Changes to the sudoers file
  • Installation of an untrustworthy root certificate
  • Installation of a legitimate LaunchAgents file named homebrew.mxcl.tor.plist
  • Installation of numerous legitimate command-line tools, consisting of tens of thousands of files

Malwarebytes Breach Remediation for Mac will detect the important components of this malware as OSX.Dok, disabling the active infection. However, when it comes to the other changes, which introduce vulnerabilities and potential behavior changes that are not easily reversed, additional measures will be needed. For people who don’t know their way around in the Terminal and the arcane corners of the system, it would be wise to seek the assistance of an expert, or erase the hard drive and restore the system from a backup made prior to infection.

The impact on business could be severe, as it could expose information that could allow an attacker to gain access to company resources. For example, consider the potential damage if an infected employee visited an internal company page providing instructions for how to connect to the company VPN and access internal company services. The malware would have sent all that information to the malicious proxy server.

If you have been infected by this malware in a business environment, you should consult with your IT department, so they can be aware of the risks and begin to mitigate them.

Apple has already revoked the certificate used to sign the app, so, at this point, anyone who encounters this malware will be unable to be infected by it.

Read the full post on Malwarebytes Labs

Thomas Reed is a self-trained developer and Apple security expert, and is director of Mac offerings at Malwarebytes. View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Want Your Daughter to Succeed in Cyber? Call Her John
John De Santis, CEO, HyTrust,  5/16/2018
Don't Roll the Dice When Prioritizing Vulnerability Fixes
Ericka Chickowski, Contributing Writer, Dark Reading,  5/15/2018
New Mexico Man Sentenced on DDoS, Gun Charges
Dark Reading Staff 5/18/2018
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
Malwarebytes protects businesses against malicious threats that escape detection by traditional antivirus solutions. Malwarebytes Anti-Malware, the companys flagship product, has a highly advanced heuristic detection engine that has removed more than five billion malicious threats from computers worldwide. SMBs and enterprise businesses worldwide trust Malwarebytes to protect their data. Founded in 2008, the company is headquartered in California with offices in Europe, and a global team of researchers and experts. For more information, please visit us at www.malwarebytes.com/business.
Featured Writers
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Typin' in my password. Somebody's shoulder surfin'. Woooh!
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-11329
PUBLISHED: 2018-05-22
The DrugDealer function of a smart contract implementation for Ether Cartel, an Ethereum game, allows attackers to take over the contract's ownership, aka ceoAnyone. After that, all the digital assets (including Ether balance and tokens) might be manipulated by the attackers, as exploited in the wil...
CVE-2018-11363
PUBLISHED: 2018-05-22
jpeg_size in pdfgen.c in PDFGen before 2018-04-09 has a heap-based buffer over-read.
CVE-2018-11364
PUBLISHED: 2018-05-22
sav_parse_machine_integer_info_record in spss/readstat_sav_read.c in libreadstat.a in ReadStat 0.1.1 has a memory leak related to an iconv_open call.
CVE-2018-11365
PUBLISHED: 2018-05-22
sas/readstat_sas7bcat_read.c in libreadstat.a in ReadStat 0.1.1 has an infinite loop.
CVE-2018-11339
PUBLISHED: 2018-05-22
An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment.