Dok is a 2017 macOS trojan, spread through phishing emails with a zip attachment, that routes your web traffic through the attackers' proxy and installs its own root certificate so it can read even encrypted pages. To check, look for a proxy you didn't set in System Settings › Network › Details › Proxies and an unfamiliar root certificate in Keychain Access.
Last reviewed · 2 sources
Also known as: OSX.Dok, Retefe
Check Point found OSX/Dok in April 2017. It came as Dokument.zip in phishing emails, mostly aimed at European users (one German-language lure claimed there were inconsistencies in a tax return), and was signed with a valid Apple developer certificate, so Gatekeeper let it run. It blocks the screen with a fake update window until you enter your password, then points the Mac's network settings at a proxy auto-configuration (PAC) file on the attackers' server and installs a new root certificate, which lets them read encrypted traffic in a man-in-the-middle attack. After Apple revoked the first developer ID, new variants appeared signed with another. XProtect 5368 (macOS 26.5, checked October 29, 2026) has signatures named OSX.Dok.A and OSX.Dok.B.
Phishing emails with a .zip attachment such as Dokument.zip, posing as tax or delivery paperwork
Signed with a valid Apple developer certificate, so Gatekeeper didn't block it
A fake update window that wouldn't go away until you typed your password
Messages in German and English, mostly aimed at European users
A proxy configuration in System Settings › Network › Details › Proxies that you didn't set up
A root certificate in Keychain Access that you or your organization didn't install
A fake 'update' window after opening an email attachment that demanded your password
An email attachment named Dokument.zip in your Downloads folder
Go to System Settings › Network › your connection › Details › Proxies, turn off Automatic proxy configuration and remove any proxy you didn't set. In Terminal, networksetup -getautoproxyurl Wi-Fi shows the current PAC address.
Open Keychain Access (search for it with Spotlight; recent macOS versions keep it out of the Utilities folder). Look in the System and login keychains for a certificate you don't recognize and delete it.
Delete the app and the zip it came in from ~/Downloads, ~/Desktop and /Applications.
Check ~/Library/LaunchAgents and /Library/LaunchAgents for plist files created around the same time, and Login Items in System Settings.
Dok can read encrypted traffic, so from another device change passwords you used while it was installed, starting with banking and email, and turn on two-factor authentication.
CoreLock's free scan checks startup items. It doesn't check proxy settings or certificates, so do those by hand as above.
Don't open zip attachments you weren't expecting, especially 'tax' or 'delivery' documents
Real macOS updates come from System Settings, never from an email attachment
Check your network proxy settings and certificates in Keychain Access now and then
Remember that a valid signature shows who signed an app, not that it's safe
What it can and can't do
CoreLock's free scan doesn't check proxy settings or root certificates, which is how Dok works, so check those by hand. Its startup-items check covers launch items Dok adds, and it can't promise to catch every variant.
RAT — MITRE ATT&CK describes Proton as a macOS backdoor focused on data theft and cred...
Trojan — Shlayer is a macOS dropper that installs adware and potentially unwanted program...
Social Engineering — ClickFix is a social-engineering technique that MITRE ATT&CK lists as User Execu...
It sends your traffic through the attackers' proxy and installs a root certificate your Mac trusts. The proxy decrypts your connection with that certificate, reads it, and opens its own connection to the real site, while your browser still shows the padlock.
It was signed with a valid Apple developer certificate, and Gatekeeper checks that apps are signed by a registered developer. Apple revoked the certificate, and Check Point then found new variants signed with a different developer ID.
Assume the passwords you typed could have been read. Contact your bank, change your online banking and email passwords from another device, watch your accounts, and turn on app-based two-factor authentication.
Check Point found it mostly targeted European users, with messages in German and English. The proxy-and-certificate technique works anywhere.
Free, with no account: the scan checks your Downloads folder against a built-in malware-hash list and 19 YARA rules.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser