New MacOS Malware Detected Spreading via Phishing E-mails

One fresh malicious program for Mac OS recently got noticed within Europe as it's getting disseminated through phishing e-mails. CheckPoint Software Technologies the security company has named it OSX/Dok whose payload gets served through a file attached to the e-mail.

A sample e-mail, which Check Point's team analyzed, was crafted as appearing like one Swiss government department's notification cautioning the reader of mistakes within his tax returns. The e-mail contains one zipped archive named Dokument.zip where the malicious program's payload is stored.

Similar as plentiful attachment-related phishing assaults, an unusual way is required for contaminating an end-user's computer. Fortunately, the Dok infection doesn't occur simply by viewing an e-mail. And for those who do become victimized with the program, iMore gives directions to get their PCs clean. Moreover, the sinister program seems as using one faked certificate which circumvents the Gatekeeper screening of Apple so it can without problem creep into the system incase the use isn't careful. And while avoiding the malware maybe easy, it is potentially extremely destructive incase it manages entry into the system whilst the user overlooks checking out for alert signals. Engadget.com posted this, April 26, 2017.

When it's just midway of the malware's loading, the malicious program that researchers dubbed OSX/Dok ensures its loading is complete by appending one fresh loginItem called AppStore to the infected end-user's Mac system. Another function the loginItem does is ensuring the loading procedure goes on even following restarting of the system.

Subsequently, nag screens are displayed during the loading act. They advise the end-user to load one emergency security update. Actually this is done for acquiring the end-user's administrative password that OSX/Dok would utilize for running different commands invisible to the end-user.

Meanwhile, the AV solutions of Mac are still to be made up-to-date so they can detect OSX/Dok. In this connection, Apple is urged to withdraw the malware creator's certificate instantly.

The most recent uncovering of the malicious program that apparently strikes mostly European end-users underscores that Macs aren't safe from the threat like it's occasionally thought. As usual, people mustn't follow web-links alternatively download attachments within electronic mails coming from untrustworthy/unfamiliar sources.

» SPAMfighter News - 5/3/2017