Check Point researchers detail Dok, OS X malware that uses a signed Apple developer certificate to bypass Gatekeeper
Context & Ripple Effects
Check Point's Dok disclosure is an early entry in a pattern the corpus keeps returning to: malware that arrives carrying a legitimately signed Apple developer certificate, so Gatekeeper — built to trust exactly that signal — waves it through. The same playbook resurfaces in OSX/Linker's exploitation of an unpatched Gatekeeper-scanning flaw two years later.
What makes the story durable is Apple's response template, visible across the related coverage: revoke the abused identity, then patch the check. That is how Apple later handled the Silver Sparrow outbreak by revoking its creator's certificates, and how the notarization flaw exposed by a researcher got closed in Big Sur 11.3. Dok is the moment that cat-and-mouse around the trust chain became explicit.
First-order effects
- Mac users who run Dok are infected by a payload Gatekeeper treats as trusted, and the immediate countermeasure available to Apple is revoking the abused developer certificate — the lever it later pulled against Silver Sparrow.
- Check Point's writeup hands Apple a specific signing identity to kill and gives enterprise defenders a concrete detection target rather than a generic malware warning.
Second-order effects
- Each signed-malware incident forces Apple to harden the next layer of the chain — the notarization-gap patch in Big Sur 11.3 and the Microsoft-reported Gatekeeper bypass Apple fixed in late 2022 are direct descendants of the weakness Dok exploited.
- Legitimate developers absorb the friction: every tightening of notarization and scanning raises the cost of shipping outside Apple's signing pipeline, deepening dependence on it.
Third-order effects
- If the pattern holds, macOS security shifts from per-app scanning toward policing revocable developer identities — which makes Apple's own certificate and notarization infrastructure the highest-value target, exactly where OSX/Linker struck next.
The trend: Mac malware increasingly attacks Apple's trust chain — signing, notarization, Gatekeeper — rather than the operating system, pushing Apple to treat its developer-identity system as a continuously policed perimeter.