Macos malware runonly applescripts avoid for

#Macos malware runonly applescripts avoid for pdf
#Macos malware runonly applescripts avoid for install
#Macos malware runonly applescripts avoid for update

If the victim yields and supplies the password, OSX.Dok proceeds to install a hidden version of tor, and several utilities to enable stealth communication: socat, filan, and procan. The only recourse victims really have at this point is a hard shutdown, followed by starting up in Safe mode to clear our not only the malware but also the persistence agents that have already been installed.

ThereвЂ™s little point in hitting вЂCancelвЂ™ as the dialog will just reappear repeatedly. The whole installation takes several minutes.Дuring this time, the keyboard is partially re-enabled to allow the victim to type in authorisation credentials in a pop-up dialog. ThereвЂ™s so much being installed, in fact, that if you have a Mac with cooling fans youвЂ™re likely to hear the fans spin up as the CPU comes under heavy load and internal heat starts to build. In this case, the вЂњgameвЂќ is to stop the user interfering while the malware installs a variety of other software. Rather, the malware authors have just leveraged the same Apple APIs that games developers use to produce an immersive experience and force players into particular game situations. Though we donвЂ™t often see this technique on macOS, this is not some new technique the hackers have conjured up. ThereвЂ™s no way for the user to cancel out or force quit from this view as the application disables the keyboard.

#Macos malware runonly applescripts avoid for update

From the userвЂ™s perspective, the first thing that happens is the entire Desktop is overtaken by a fake вЂњApp StoreвЂќ update splash screen. This is more obvious if the DMG is opened in the FinderвЂ™s column or list view:Дouble-clicking the Dokument.app launches a variety of tasks and installs a number of applications in the background.

Although we havenвЂ™t seen examples of how it is propagated, given the DMG is entitled DHL_Dokument (DHL is a German postal service and international courier company) and contains German text, weвЂ™d hazard a guess that it may well be targeting the same groups and using a similar email trick as before.Д«arely visible at the bottom of the view is the file name that reveals itвЂ™s true nature: вЂDokument.appвЂ™.

#Macos malware runonly applescripts avoid for pdf

The malware apparently targeted mostly European Mac users and was spread via an email phishing campaign that attempted to convince the user there was some problem with their tax returns.ДЄ similar trick is used in the new version, only вЂњDokumentвЂќ is now a fake Adobe PDF icon, with the instruction вЂњClick twice on the icon to view the documentвЂќ in German, presented when the user mounts the DMG. The 2017 version of OSX.Dok used a fake Preview icon to disguise an application bundle. OSX.Dok is packaged inside a DMG called either DHL_Dokument.dmg or Strichkode DHL Express.dmg and uses the bundle identifier Swisscom.Application.

Nevertheless, as weвЂ™ll see in this post, that has not stopped the attackers from continuing to compromise Mac users. Shortly after, the developerвЂ™s signature was revoked by the Cupertino company. We first spotted it on the 9th January and informed Apple through unofficial channels. The story began on Christmas Day, when a new variant of OSX.Dok was signed with a valid Developer ID at 12:48pm on 25th December, 2018. In this post, we take a look at how it works and explain how we discovered that new infections are occurring even as we write. First discovered in 2017, OSX.Dok is a little more sophisticated than most malware that targets macOS, and weвЂ™re not surprised to see it back in 2019.