Mac File Opener adware abuses document handlers

Adware called 'Mac File Opener' abuses macOS's Launch Services document-handler registration to gain execution without a traditional persistence mechanism.

This technical writeup from Objective-See dissects a piece of OS X adware, dubbed 'Mac File Opener' and bundled inside an 'Advanced Mac Cleaner' installer, first identified by Malwarebytes researcher Thomas Reed. Rather than installing a login item, launch agent, or launch daemon, the malware registers itself in its Info.plist as a 'document handler' for over 200 file types via the CFBundleDocumentTypes key. When a user opens a file of one of these types (and no other app is already registered as the handler), macOS's Launch Services automatically executes the malware.

The author reverse-engineers the underlying OS mechanics, tracing how the lsd daemon parses an application's Info.plist upon its arrival on disk, extracts CFBundleDocumentTypes entries, and persists them to a Launch Services database (a .csstore file) via internal LaunchServices framework calls such as _LSCreateRegistrationData, LSBundleRecordBuilder::registerBundleRecord, and _LSRegisterDocumentTypes. At runtime, when a user opens a matching file, Finder/LaunchServices resolves the registered handler through _LSBundleCopyOrCheckNode and launches the malicious app via spawn_via_launchd.

While this is an 'unreliable' persistence technique requiring user interaction, it notably bypasses monitoring tools (like BlockBlock) that watch for traditional autostart mechanisms. The malware sample was also signed with a legitimate Apple Developer ID belonging to 'Techyutils Software Private Limited,' allowing it to pass Gatekeeper checks. The piece is primarily a research/technical deep-dive rather than an active-campaign alert, and closes with the author considering whether security tools like KnockKnock should surface document-handler registrations as a monitored technique.

Source reporting: https://objective-see.org/blog/blog_0x12.html