New Os X 2017 Install TOR And

According to Malwarebytes, the tech giant has since revoked the certificate used to sign the app, an action which causes a warning dialog box to pop up if the user attempts to unzip the.zip archive.

Dok uses this alert as a cover to copy itself to the UsersShared folder and execute itself there.

It will also use that location to add itself to the users login items, which means it will re-open at the next login.

New Os X 2017 Install TOR And

Why So that it can gain administrator privileges and thereby install Homebrew, a command line installation tool which it uses to install TOR and SOCAT.

The former allows a user to connect to the dark web, whereas the latter shuffles data between two communications.

Dok then installs a root certificate, which grants the malware the ability to perform a man in the middle (MitM) attack, impersonate any website the user visits, and tamper with their traffic.

Victims should delete these files to remove the malware from their machines.

They will also need to remove the bad certificate from their System keychain and use a good text editor to reverse some modifications made to the sudoers file.

Finally, they can elect to remove the command line tools, but thats not an easy process.