VORANT. Threat Intelligence Sign in Get the full feed

Adware Doctor App Exfiltrates Mac Browser History

routine threat

Adware Doctor, a top-grossing Mac App Store utility, secretly collected users' Safari, Chrome and Firefox history plus system data and uploaded it to remote servers.

Researchers found that Adware Doctor, a paid anti-adware utility that ranked as the #4 top-grossing app and #1 paid utility in the official Mac App Store, was secretly harvesting and exfiltrating sensitive user data. Despite running inside Apple's App Sandbox, the app abused a user-granted file-access entitlement (obtained under the guise of legitimate adware scanning) to read Safari, Chrome and Firefox history databases, App Store search history, a list of downloaded installers, and system/process information. It then zipped this data into a password-protected archive and uploaded it over HTTPS to yelabapp.com infrastructure via an API endpoint named 'checkadware'.

Analysis of the binary revealed the app also circumvented sandbox restrictions on process enumeration (normally blocking /bin/ps) by directly invoking sysctl/KERN_PROC_ALL logic copied from Apple's own sample code, a technique that should not be permitted for sandboxed App Store apps. The app has a documented history of AppleScript abuse, name-squatting on a competitor's brand, and fake reviews, and its developer identity ('Yongming Zhang') could not be substantively verified. Despite being reported to Apple roughly a month prior, the app remained available until public disclosure forced its removal, raising concerns about the effectiveness of Apple's App Store review and vetting process.

The exfiltration endpoint (adscan.yelabapp.com) went offline shortly before publication, though the app's local collection logic remained active and could resume exfiltration if the endpoint were restored. The incident illustrates how App Store review can miss sandbox-bypass techniques and covert data collection even in top-grossing, widely trusted applications.

Mentioned in this report

Threat actors Yongming Zhang
Malware Adware Doctor

Detection guidance

macOS Process Reading Browser History Databases

ATT&CK T1005

Detects processes accessing Safari, Chrome, or Firefox history database files - indicative of data collection from local system. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: macOS Process Reading Browser History Databases
description: Detects file access to browser history databases (Safari History.db,
  Chrome History, Firefox places.sqlite) by processes that are not the browsers themselves
  - typical of data exfiltration malware.
tags:
- attack.collection
- attack.t1005
logsource:
  category: file_event
  product: macos
detection:
  selection:
    TargetFilePath|contains:
    - /Library/Safari/History.db
    - /Library/Application Support/Google/Chrome/Default/History
    - /.mozilla/firefox/
    TargetFilePath|endswith:
    - places.sqlite
    - places.sqlite-wal
  filter_browser_process:
    Image|endswith:
    - /Safari
    - /Google Chrome
    - /firefox
    - /Chromium
  condition: selection and not filter_browser_process
falsepositives:
- Backup or migration tools legitimately copying browser profiles
- Browser sync agents accessing history for legitimate sync operations
level: high
id: 2e9fda55-c857-5163-b92b-327f6df99f0e
status: experimental
author: Vorant

macOS Process Enumerating Processes via sysctl

ATT&CK T1057

Detects sandboxed processes invoking sysctl with KERN_PROC_ALL to enumerate running processes, bypassing sandbox process discovery restrictions. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: macOS Process Enumerating Processes via sysctl
description: Detects processes calling sysctl with KERN_PROC_ALL or similar process
  enumeration constants - a sandbox bypass technique for process discovery. Sandboxed
  App Store apps should not have capability to enumerate arbitrary processes.
tags:
- attack.discovery
- attack.t1057
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    CommandLine|contains:
    - sysctl
    - KERN_PROC
    CommandLine|re: (kern\.proc|KERN_PROC_ALL|KERN_PROC_PID)
  filter_system_process:
    Image|contains:
    - /usr/bin/sysctl
    - /System/Library
    - /Library/Preferences
  filter_legitimate_admin:
    ParentImage|contains:
    - /usr/local/bin
    - /opt/homebrew
  condition: selection and not (filter_system_process or filter_legitimate_admin)
falsepositives:
- System monitoring tools and legitimate security software
- Administrator scripts for system diagnostics
level: medium
id: 6f3812c3-2d9e-590a-8a0e-740cf97e46fb
status: experimental
author: Vorant

macOS Process Creating Password-Protected Archive and Uploading to C2

ATT&CK T1041

Detects processes creating encrypted archives (zip with password) and performing HTTPS uploads to suspicious domains - typical data exfiltration pattern. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: macOS Process Creating Password-Protected Archive and Uploading to C2
description: Detects processes spawning zip/archive commands with password flags followed
  by network connections to upload data - indicative of automated data collection
  and exfiltration over C2 channel.
tags:
- attack.exfiltration
- attack.t1041
- attack.t1119
logsource:
  category: process_creation
  product: macos
detection:
  selection_zip:
    CommandLine|contains:
    - zip
    - ditto
    CommandLine|re: (-P|--password|-e)\s+\S+
  selection_suspicious_context:
    ParentImage|endswith:
    - Adware Doctor
    - AdwareDoctor
    CommandLine|contains:
    - Safari
    - Chrome
    - Firefox
    - History
  filter_legitimate_backup:
    CommandLine|contains:
    - Time Machine
    - Migration
    - rsync
  condition: (selection_zip and selection_suspicious_context) and not filter_legitimate_backup
falsepositives:
- Legitimate backup utilities creating encrypted archives of user data
- IT deployment scripts automating encrypted backups
level: high
id: bdea7a7f-4ab0-56bc-a170-161c6bf0baeb
status: experimental
author: Vorant

1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x37.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free