A proxy Trojan can turn a Mac into a hidden relay, letting someone route other internet traffic through the computer and its IP address. A Dark Reading report published December 7, 2023, described malware bundled with pirated Mac applications that did this. The report is historical; the available sources do not establish whether that campaign is still active or how common it is today.
What the 2023 report said the Trojan did
Dark Reading summarized a Kaspersky report published that week. The reported Trojan was distributed inside pirated copies of legitimate business software, including editing, data-recovery, and network-scanning applications. During installation, it presented itself as the expected program, then created a hidden proxy on the Mac. That proxy could allow threat actors to route other traffic through the compromised computer and use its internet connection and IP address. Dark Reading’s December 7, 2023 report does not establish that the same campaign remains active.
A proxy is an intermediary between a device and an online destination. In this case, the victim’s Mac could act as the intermediary for traffic that did not belong to the victim. Potential consequences described in the report included slower internet service or consumed data, advertising-view fraud, botnet or DDoS activity, and unlawful activity that appears to come from the victim’s IP address. These were possible uses, not confirmed outcomes for every infected Mac.
How the reported samples communicated
Kaspersky reportedly observed related Android, Windows, and macOS samples associated with one command-and-control (C2) server. The report said those samples used DNS-over-HTTPS (DoH) for C2 communications. DoH carries DNS requests inside HTTPS connections, so a monitor that watches only conventional DNS traffic might not see those requests as ordinary DNS lookups. This is a reported behavior of those samples, not a defining feature of every proxy Trojan.
#1 Best Overall
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
How to check your Mac’s proxy settings
- Choose Apple menu > System Settings.
- Select Network, then select the network service you use, such as Wi-Fi.
- Choose Details, then open Proxies.
- Review the proxy options and any configured server details. If a setting is unfamiliar, note it and investigate before changing it; some networks intentionally use proxies.
Malwarebytes documents this route in its OSX.AgentProxy guidance. A changed or unfamiliar proxy setting is a reason to investigate, not proof of malware by itself. Network administrators, employers, VPNs, and other legitimate tools may configure proxy settings.
What proxy settings can—and cannot—tell you
Proxy settings are one useful clue, but they are not a complete malware check. Malwarebytes describes OSX.AgentProxy as a Trojan that changes Mac proxy settings and says its Malwarebytes for Mac product detects and removes that named detection. It describes OSX.MalProxy as a generic detection name for macOS malware that inserts itself as a proxy, with the potential to eavesdrop on or alter data in a connection. Those are vendor descriptions of its detections and product capabilities, not independent comparative test results. Malwarebytes’ OSX.MalProxy explanation does not establish that every proxy change or proxy-related threat will be detected by a particular product.
Rank #2
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
What to do if you installed a cracked Mac app
- Stop using the untrusted app. Avoid launching it again while you assess the Mac.
- Check the network service’s Proxies settings using the steps above. Record unfamiliar values and consider whether a workplace, school, VPN, or network administrator set them legitimately.
- Use a reputable Mac security tool if you need help checking the system. Confirm that it supports macOS and review what its detection and removal claims cover; no single product claim proves universal detection.
- Ask for help if the Mac is managed or the settings are unclear. A workplace IT team or qualified technician can distinguish an authorized proxy from an unexpected one.
- Get software only from its developer or an authorized store. Avoiding pirated downloads from unauthorized websites is the direct prevention advice in the Kaspersky report.
Kaspersky expert Sergey Puzan recommended a security solution with network-traffic analysis and monitoring traffic and file-system changes. He also suggested blocking the C2 IP address. That kind of blocking depends on having a reliable, current indicator and should not be treated as a general fix for an unknown infection. The report does not provide evidence that any one response step guarantees removal.
Dok is a separate macOS proxy example
MITRE ATT&CK documents Dok as a distinct macOS threat that has used a malicious proxy to redirect traffic and potentially monitor or alter HTTP(S) traffic. Its entry also describes behaviors including login-item and LaunchAgent persistence, credential prompts, and a root-certificate installation technique. These details apply to Dok, not automatically to the Trojan in the 2023 report. MITRE ATT&CK’s Dok entry lists macOS as the platform and identifies the page as version 2.0, last modified November 17, 2024.
Rank #3
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
What the report does not establish
The campaign coverage dates to December 2023. The cited sources do not establish the campaign’s current activity, prevalence in 2026, or the outcome for any specific Mac. Dark Reading also reported that Accenture’s 2023 report described a tenfold rise since 2019 in Dark Web threat actors targeting macOS; that figure is secondhand here, as reported by Dark Reading, rather than a direct review of Accenture’s report.
Quick Recap
Best Value
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Rank #4
![Norton 360 Premium 2027 Antivirus, 10 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41JNWru8mYL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 10 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
