TF-MAL-osx.retefe

Description

ThreatFox malware family `osx.retefe`. Printable name: Dok. Aliases: Retefe.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• Dok, Software S0281 | MITRE ATT&CK®
  web:attack.mitre.org

  Dok is a Trojan application disguised as a .zip file that is able to collect user credentials and install a malicious proxy server to redirect a user's network traffic (i.e. Adversary-in-the-Middle).

  2026-05-22 05:29 UTC
• Dok - macOS Malware Encyclopedia
  web:macos.checkpoint.com

  This is another macOS malware ported from Windows ("Retefe"). Dok spreads via a phishing mail, and usually targets European macOS users. The malware installs...

  2026-05-22 05:29 UTC
• Remove OSX/Dok malware from Mac OS X - MacSecurity.net
  web:macsecurity.net

  Learn how the OSX/ Dok Mac malware spreads, how it manifests itself when inside a machine, what objectives it pursues, and how to remove it from infected Mac.

  2026-05-22 05:29 UTC
• Dok (Malware Family)
  web:malpedia.caad.fkie.fraunhofer.de

  Dok a.k.a. Retefe is the macOS version of the banking trojan Retefe. It consists of a codesigned Mach-O dropper usually malspammed in an app bundle within a DMG disk image, posing as a document. The primary purpose of the dropper is to install a Tor client as well as a malicious CA certificate and proxy pac URL, in order to redirect traffic to targeted sites through their Tor node, effectively ...

  2026-05-22 05:29 UTC
• RESURGE Malware and CVE-2025-0282: Critical Threats and Defender ...
  web:windowsforum.com

  The emergence of RESURGE signals more than just another entry in a long line of malware threats. According to CISA, RESURGE contains advanced persistence features inherited from the SPAWNCHIMERA malware family—a group notorious for its ability to survive system reboots and avoid simplistic remediation .

  2026-05-22 05:29 UTC
• Malware Incident Response: The 7-Step Playbook for 2025 - Breachsense
  web:www.breachsense.com

  Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.

  2026-05-22 05:29 UTC
• Technical Approaches to Uncovering and Remediating Malicious ... - CISA
  web:www.cisa.gov

  It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.

  2026-05-22 05:29 UTC
• Malwarebytes Threat Alert | OSX.Dok
  web:www.malwarebytes.com

  Protection Malwarebytes for Mac detects and removes OSX. Dok . Remediation Malwarebytes Anti- Malware for Mac will detect and remove the important components of OSX. Dok , disabling the active infection.

  2026-05-22 05:29 UTC
• New "Dok" Mac OSX Malware Steals Sensitive Data
  web:www.securityweek.com

  Endpoint Security New " Dok " Mac OSX Malware Steals Sensitive Data New malware able to spy on OSX users' internet traffic, including https traffic, has been found targeting European users. The malware was previously not stopped by Apple's Gatekeeper, and when discovered was not detected by anti- malware signature engines.

  2026-05-22 05:29 UTC

Only Available for Registered Users. Sign in to view.