This is perhaps more eloquently stated by the CheckPoint researchers: "As a result of all of the above actions, when attempting to surf the web, the user's web browser will first ask the attacker web page on TOR for proxy settings. The user traffic is then redirected through a proxy controlled by the attacker, who carries out a Man-In-the-Middle attack and impersonates the various sites the user attempts to surf. The attacker is free to read the victim's traffic and tamper with it in any way they please. So why redirect the user's traffic. However, as OSX/Dok is a port of a Windows banking trojan (Retefe), its main goal is to extract user's banking credentials from the redirected traffic, or manipulate traffic in order to gain access to financial accounts. For more information on this methodology, check out CheckPoint's follow-up report: OSX/Dok Refuses to Go Away and It's After Your Money. disinfection: Fully cleaning up a OSX/Dok infection is somewhat difficult due to the multitude of changes it makes to an infected system. First, if it still exists, remove the malware's initial Login Item ('AppStore'). Then, delete the two Launch Agents