2017 Mac Malware Roundup: Proton, XAgent, Dok
Objective-See recaps four 2017 macOS threats—Proton, APT28's XAgent/Komplex, FileCoder ransomware, and the Dok banking trojan—spread via supply-chain and phishing attacks.
This retrospective from Objective-See details several distinct macOS malware families active throughout 2017. OSX/Proton, a feature-complete backdoor sold as malware-as-a-service, spread through supply-chain compromises of legitimate developer sites (HandBrake mirror, Eltima applications) and a fake Symantec blog, stealing browser credentials, keychains, 1Password vaults, and GnuPG keys while persisting via Launch Agents. Notably, variant C was signed with a legitimate (later revoked) Apple Developer ID to bypass Gatekeeper.
The post also examines OSX/XAgent, attributed to APT28/Sofacy (Fancy Bear), a fully-featured second-stage macOS implant delivered via the OSX/Komplex downloader and capable of keylogging, screen capture, app injection, and iOS backup discovery; it appears to avoid persistence to reduce detection risk, relying instead on Komplex's Launch Agent. Additionally, FileCoder (FindZip/Patcher) ransomware, distributed via pirated-software torrents, encrypts victim files with a password-protected zip using a key that is never transmitted to the attacker—rendering ransom payment useless, though a known-plaintext attack allows recovery. Finally, OSX/Dok, a macOS port of the Retefe banking trojan, was delivered via a coordinated phishing campaign against German users and installs a malicious proxy (routed through Tor) to perform MitM attacks on victim web traffic for banking credential theft.
Mentioned in this report
Detection guidance
macOS Launch Agent Creation for Persistence
Detects creation or modification of LaunchAgent plist files in standard persistence directories, common in macOS malware establishing foothold. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: macOS Launch Agent Creation for Persistence
description: Detects creation or modification of .plist files in ~/Library/LaunchAgents
or /Library/LaunchAgents directories, typical macOS persistence mechanism used by
backdoors like Proton and XAgent downloaders.
tags:
- attack.persistence
- attack.t1543.001
logsource:
category: file_event
product: macos
detection:
selection:
TargetFilename|contains:
- /Library/LaunchAgents/
- /Library/LaunchDaemons/
TargetFilename|endswith: .plist
Image|endswith:
- /bash
- /sh
- /zsh
- /cp
- /mv
- /defaults
condition: selection
falsepositives:
- Legitimate application installers or system admin tools creating LaunchAgents
- User configuration management scripts
level: high
id: af3c6f9f-8995-5cb5-9051-d26149e76ecc
status: experimental
author: Vorant
Keychain and Password Manager Access via Command-Line
Detects suspicious shell commands accessing macOS Keychain, 1Password vaults, or GnuPG keys from non-native password management processes. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Keychain and Password Manager Access via Command-Line
description: Detects command-line access to macOS Keychain (security command), 1Password
vaults, or GnuPG key stores from suspicious processes. Malware like Proton steals
credentials from multiple password stores.
tags:
- attack.credential-access
- attack.t1555
logsource:
category: process_creation
product: macos
detection:
selection_keychain:
Image|endswith:
- /bash
- /sh
- /zsh
CommandLine|contains:
- security find-generic-password
- security find-internet-password
- security dump-keychain
selection_1password:
CommandLine|contains:
- ~/.1password
- /1Password
- op get
selection_gpg:
CommandLine|contains:
- ~/.gnupg
- gpg --list-secret-keys
- gpg --export-secret-keys
filter_legitimate:
ParentImage|endswith:
- /Finder
- /System Preferences
- /1Password 7
- /Keychain Access
condition: (selection_keychain or selection_1password or selection_gpg) and not
filter_legitimate
falsepositives:
- Legitimate credential management automation scripts
- Password manager native processes accessing their own stores
level: high
id: 1ffd0e26-bff7-5ad2-8684-0416215812fc
status: experimental
author: Vorant
Proxy Installation via Network Configuration
Detects configuration of system-wide HTTP/HTTPS proxies pointing to suspicious hosts or localhost, indicative of MitM proxy malware like OSX/Dok. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Proxy Installation via Network Configuration
description: Detects suspicious modifications to macOS network proxy settings (com.apple.networkprefs
or scutil commands) to redirect traffic through a malicious proxy. OSX/Dok and similar
MitM malware use this for credential interception.
tags:
- attack.command-and-control
- attack.t1090
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith:
- /scutil
- /defaults
CommandLine|contains:
- ' set '
- ' write '
filter_apple_update:
CommandLine|contains:
- Apple\\.
- software.update
condition: selection and not filter_apple_update
falsepositives:
- Legitimate corporate proxy deployment tools
- System administrators configuring enterprise proxies
level: medium
id: 5be924c0-30da-5226-99a5-b26d52758441
status: experimental
author: Vorant
1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x25.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free