It shouldn’t really be a surprise when a Mac is attacked via malware. Admittedly, the larger number of Windows systems in use has influenced the route that cybercriminals usually choose, which typically meant fewer occurrences of Mac malware. But, despite the lower numbers of Mac systems, 9to5Mac reported that Mac-targeted attacks rose 744 percent in 2016 Q4, according to data from McAfee Labs.

A New Mac Malware

Checkpoint Software found a new example of malware infecting German users. It is part of a major effort, made up of several different schemes.

Dok, as it is called, is able to totally take over a Mac until the infection process is complete and then erase itself. Attackers will gain complete access to all the victim’s communication, including communication that is SSL encrypted — a particular trick done by redirecting traffic through a malicious proxy server. Bleeping Computer reported the malware had a zero percent detection rate on VirusTotal when it was discovered.

The virus starts off as a malicious attachment in a phishing email. When the attached Dokument.zip is opened, it first sets up a fake login item in the AppStore. That ensures persistence of the malware when the computer is restarted.

In the second phase, a fake window asserts that new OSX updates are available for download. It may stop all other windows from becoming active while displayed. Clicking the window’s OK button brings up a dialog box the user is directed to fill in, providing the Mac’s administrative password.

Once it has that password, Dok goes to town, installing a new root certificate. It also changes the network settings so all outgoing connections must pass through a proxy. That proxy is dynamically changed using a Proxy AutoConfiguration (PAC) file, which sits on a malicious server.

Bringing in Basic Security Practices

Certain preventable actions are necessary for this malware scheme to succeed. For example, users should not to click on unknown attachments, which applies to a lot of malware attacks. Secondly, they should not give an unknown dialog box the system’s administrative password. A page that tries this is nonstandard, which serves as a dead giveaway.

Ultimately, the question is, “How did the malware get a valid developer certificate?” There is a feature called GateKeeper on Macs that stops unknown programs from running unless a valid certificate is present. Yet, this malware somehow bypassed the security feature.

Apple needs to carefully check its entire issuance process so this doesn’t happen again, as well as immediately revoke the malware’s certificate.