Dok

Description

Dok is a macOS trojan that spread through phishing emails in 2018, primarily targeting users in Germany. It hijacked network traffic by changing system proxy settings, installed a root certificate to intercept encrypted connections, and stole browsing and credential data from infected machines.

Stats

First seen: April 2022
Last seen: September 2026

Also known as

Retefe

MITRE ATT&CK techniques

11 techniques across 9 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.002AppleScript

TA0003 Persistence

T1543Create or Modify System Process
- T1543.001Launch Agent
T1547Boot or Logon Autostart Execution
- T1547.015Login Items

TA0004 Privilege Escalation

T1548Abuse Elevation Control Mechanism
- T1548.003Sudo and Sudo Caching

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.002Software Packing

TA0006 Credential Access

T1557Adversary-in-the-Middle

TA0009 Collection

T1056Input Capture
- T1056.002GUI Input Capture

TA0011 Command and Control

T1090Proxy
- T1090.003Multi-hop Proxy

TA0010 Exfiltration

T1048Exfiltration Over Alternative Protocol
- T1048.003Exfiltration Over Unencrypted Non-C2 Protocol

TA0112 Defense Impairment

T1222File and Directory Permissions Modification
- T1222.002Linux and Mac Permissions
T1553Subvert Trust Controls
- T1553.004Install Root Certificate

Alert name variants

Alert Name	Engine
ByteCode-MSIL.Trojan.Retefe	ATP Sandbox Adv. Heuristics
Script-JS.Trojan.Retefe	ATP Sandbox Adv. Heuristics
Trojan.MAC.Dok.A	AV
Win32.Trojan.Retefe	ATP Sandbox Adv. Heuristics

Related blogs

Stepping Stone Attack launches EternalBlue Internally

November 2, 20175 min read