Adware Doctor App Exfiltrates Mac Browser History

PublishedThe source gives no date · added 2 August 2026 Vorant ratingroutine threat

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Adware Doctor, a top-grossing Mac App Store utility, secretly collected users' Safari, Chrome and Firefox history plus system data and uploaded it to remote servers.

Sourceobjective-see.org — open the original

What to check

Applies to: Whether this concerns you is not assessed; the names the report mentions are listed below.
Date: The source gives no publication date; the date shown is the day Vorant added the brief.

Researchers found that Adware Doctor, a paid anti-adware utility that ranked as the #4 top-grossing app and #1 paid utility in the official Mac App Store, was secretly harvesting and exfiltrating sensitive user data. Despite running inside Apple's App Sandbox, the app abused a user-granted file-access entitlement (obtained under the guise of legitimate adware scanning) to read Safari, Chrome and Firefox history databases, App Store search history, a list of downloaded installers, and system/process information. It then zipped this data into a password-protected archive and uploaded it over HTTPS to yelabapp.com infrastructure via an API endpoint named 'checkadware'.

Analysis of the binary revealed the app also circumvented sandbox restrictions on process enumeration (normally blocking /bin/ps) by directly invoking sysctl/KERN_PROC_ALL logic copied from Apple's own sample code, a technique that should not be permitted for sandboxed App Store apps. The app has a documented history of AppleScript abuse, name-squatting on a competitor's brand, and fake reviews, and its developer identity ('Yongming Zhang') could not be substantively verified. Despite being reported to Apple roughly a month prior, the app remained available until public disclosure forced its removal, raising concerns about the effectiveness of Apple's App Store review and vetting process.

The exfiltration endpoint (adscan.yelabapp.com) went offline shortly before publication, though the app's local collection logic remained active and could resume exfiltration if the endpoint were restored. The incident illustrates how App Store review can miss sandbox-bypass techniques and covert data collection even in top-grossing, widely trusted applications.

Mentioned in this report

Threat actors Yongming Zhang

Malware Adware Doctor

Detection guidance

macOS Process Enumerating Processes via sysctl

ATT&CK T1057 · status experimental · needs macos process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects sandboxed processes invoking sysctl with KERN_PROC_ALL to enumerate running processes, bypassing sandbox process discovery restrictions. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: macOS Process Enumerating Processes via sysctl
description: Detects processes calling sysctl with KERN_PROC_ALL or similar process
  enumeration constants - a sandbox bypass technique for process discovery. Sandboxed
  App Store apps should not have capability to enumerate arbitrary processes.
tags:
- attack.discovery
- attack.t1057
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    CommandLine|contains:
    - sysctl
    - KERN_PROC
    CommandLine|re: (kern\.proc|KERN_PROC_ALL|KERN_PROC_PID)
  filter_system_process:
    Image|contains:
    - /usr/bin/sysctl
    - /System/Library
    - /Library/Preferences
  filter_legitimate_admin:
    ParentImage|contains:
    - /usr/local/bin
    - /opt/homebrew
  condition: selection and not (filter_system_process or filter_legitimate_admin)
falsepositives:
- System monitoring tools and legitimate security software
- Administrator scripts for system diagnostics
level: medium
id: 6f3812c3-2d9e-590a-8a0e-740cf97e46fb
status: experimental
author: Vorant

macOS Process Creating Password-Protected Archive and Uploading to C2

ATT&CK T1041 · status experimental · needs macos process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects processes creating encrypted archives (zip with password) and performing HTTPS uploads to suspicious domains - typical data exfiltration pattern. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: macOS Process Creating Password-Protected Archive and Uploading to C2
description: Detects processes spawning zip/archive commands with password flags followed
  by network connections to upload data - indicative of automated data collection
  and exfiltration over C2 channel.
tags:
- attack.exfiltration
- attack.t1041
- attack.t1119
logsource:
  category: process_creation
  product: macos
detection:
  selection_zip:
    CommandLine|contains:
    - zip
    - ditto
    CommandLine|re: (-P|--password|-e)\s+\S+
  selection_suspicious_context:
    ParentImage|endswith:
    - Adware Doctor
    - AdwareDoctor
    CommandLine|contains:
    - Safari
    - Chrome
    - Firefox
    - History
  filter_legitimate_backup:
    CommandLine|contains:
    - Time Machine
    - Migration
    - rsync
  condition: (selection_zip and selection_suspicious_context) and not filter_legitimate_backup
falsepositives:
- Legitimate backup utilities creating encrypted archives of user data
- IT deployment scripts automating encrypted backups
level: high
id: bdea7a7f-4ab0-56bc-a170-161c6bf0baeb
status: experimental
author: Vorant

1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x37.html

Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account What it costs