Author: Lucian Constantin / Source: PCWorld
A new malware program that targets macOS users is capable of spying on encrypted browser traffic to steal sensitive information.
The new program, dubbed OSX/Dok by researchers from Check Point Software Technologies, was distributed via email phishing campaigns to users in Europe.
One of the rogue emails was crafted to look as if it was sent by a Swiss government agency warning recipients about apparent errors in their tax returns. The malware was attached to the email as a file called Dokument.zip.
What makes OSX/Dok interesting is that it was digitally signed with a valid Apple developer certificate. These certificates are issued by Apple to members of its developer program and are needed to publish applications in the official Mac App Store.
Applications signed with an Apple-issued developer certificate can also be installed on the latest versions of macOS without triggering security errors or requiring manual overrides, so it’s not hard to see why this would be valuable to a malware program.
It’s not clear if Dok’s creators paid to obtain a developer certificate by joining Apple’s developer program with a fake identity or if they stole the certificate from a legitimate developer.
Once installed on a Mac, OSX/Dok displays a fake and persistent notification about a system security update that needs to be installed. Users who agree to install the update will be prompted for their administrator password.
…
Click here to read more
