New Mac malware hijacks Internet traffic on compromised servers

Yes, Macs tend to be safer than a Windows PC. Among the various security measures included in the operating system is Gatekeeper, which checks that the apps that you launch contain a valid certificate and only then allow the software to boot. A new malware, called OSX/Dok, is installed on the Mac from a phishing mail, and it acts very cunningly: it installs itself as a login element named “AppStore” so to start each time you turn on or reboot the Mac. The reason why it is granted the installation is that it contains a valid certificate stolen by some good developer.

With a name like “AppStore”, it wouldn’t raise a suspect even if someone went to check the login elements. Meanwhile, it downloads all that it needs to prompt a fake update screen for your operating system. If you launch this fake update, malware changes your network settings and passes all your traffic through infected servers. Anything you do on the Internet at this point can be intercepted and modified by OSX/Dok developers, including activities on HTTPS sites.

Making this particular malware ineffective should be easy enough: Apple has probably already revoked the fake certificate, and this should allow Gatekeeper to prevent malware activation. But this allows us to remind you, once again, not to trust any emails you receive, especially if you are unsure of the sender, especially if they contain zip files. And in doubt, check your Mac with an antivirus.

Posted in:

Leave a Reply

Your email address will not be published. Required fields are marked *