VORANT. Threat Intelligence Sign in Get the full feed

Mac File Opener adware abuses document handlers

routine threat

Adware called 'Mac File Opener' abuses macOS's Launch Services document-handler registration to gain execution without a traditional persistence mechanism.

This technical writeup from Objective-See dissects a piece of OS X adware, dubbed 'Mac File Opener' and bundled inside an 'Advanced Mac Cleaner' installer, first identified by Malwarebytes researcher Thomas Reed. Rather than installing a login item, launch agent, or launch daemon, the malware registers itself in its Info.plist as a 'document handler' for over 200 file types via the CFBundleDocumentTypes key. When a user opens a file of one of these types (and no other app is already registered as the handler), macOS's Launch Services automatically executes the malware.

The author reverse-engineers the underlying OS mechanics, tracing how the lsd daemon parses an application's Info.plist upon its arrival on disk, extracts CFBundleDocumentTypes entries, and persists them to a Launch Services database (a .csstore file) via internal LaunchServices framework calls such as _LSCreateRegistrationData, LSBundleRecordBuilder::registerBundleRecord, and _LSRegisterDocumentTypes. At runtime, when a user opens a matching file, Finder/LaunchServices resolves the registered handler through _LSBundleCopyOrCheckNode and launches the malicious app via spawn_via_launchd.

While this is an 'unreliable' persistence technique requiring user interaction, it notably bypasses monitoring tools (like BlockBlock) that watch for traditional autostart mechanisms. The malware sample was also signed with a legitimate Apple Developer ID belonging to 'Techyutils Software Private Limited,' allowing it to pass Gatekeeper checks. The piece is primarily a research/technical deep-dive rather than an active-campaign alert, and closes with the author considering whether security tools like KnockKnock should surface document-handler registrations as a monitored technique.

Mentioned in this report

Malware Mac File Opener

Detection guidance

Suspicious Application Registered as Document Handler via CFBundleDocumentTypes

ATT&CK T1546

Detects when an application registers itself as a handler for multiple file types via CFBundleDocumentTypes in Info.plist, a technique used to achieve event-triggered execution when users open files. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Application Registered as Document Handler via CFBundleDocumentTypes
description: Detects registration of an application as a document handler for multiple
  file types via CFBundleDocumentTypes key in Info.plist. This technique is used to
  trigger automatic execution when users open matching file types, bypassing traditional
  persistence mechanisms.
tags:
- attack.persistence
- attack.t1546
logsource:
  category: file_event
  product: macos
detection:
  selection:
    TargetFilename|contains:
    - Info.plist
    CommandLine|contains:
    - CFBundleDocumentTypes
    Image|endswith:
    - /lsd
    - /LaunchServices
  filter_legitimate_apps:
    Image|contains:
    - /Applications/
    CommandLine|contains:
    - Apple
    - com.apple
  condition: selection and not filter_legitimate_apps
falsepositives:
- Legitimate third-party applications registering document handlers during first-run
  installation
- Productivity software (document editors, media players) registering support for
  common file types
level: medium
id: 943b2cbb-dcca-5dbd-b81f-43047c1967a6
status: experimental
author: Vorant

Unsigned or Developer-ID-Signed Application Spawned via LaunchServices File Handler

ATT&CK T1546

Detects when an unsigned or Developer-ID-signed application is executed by the LaunchServices daemon in response to file opening, indicating potential abuse of document handler registration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Unsigned or Developer-ID-Signed Application Spawned via LaunchServices File
  Handler
description: Detects execution of an application by the LaunchServices daemon (lsd)
  when a user opens a file, where the launched application is unsigned or signed with
  a Developer ID. This indicates potential abuse of CFBundleDocumentTypes registration
  for persistence.
tags:
- attack.persistence
- attack.t1546
- attack.t1553.002
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    ParentImage|endswith:
    - /lsd
    - /launchd
    Image|endswith:
    - .app/Contents/MacOS/*
    CommandLine|contains:
    - open
  filter_system_apps:
    Image|contains:
    - /System/Applications/
    - /Library/CoreServices/
  filter_user_trusted:
    SignatureStatus: valid
    SignedBy|contains: Apple
  condition: selection and not (filter_system_apps or filter_user_trusted)
falsepositives:
- Third-party document editors launched as default handlers by LaunchServices
- Developer applications with valid Developer ID signatures opening associated file
  types
level: high
id: c5facd07-5374-591d-9215-7495aecdc00a
status: experimental
author: Vorant

Modification of LaunchServices Database for Document Handler Registration

ATT&CK T1546

Detects modifications to LaunchServices .csstore database files and registration cache, which occur when an application registers itself as a handler for file types. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Modification of LaunchServices Database for Document Handler Registration
description: Detects writes to LaunchServices database files (.csstore, plist caches)
  in user or system Library directories, which are modified when applications register
  themselves as document handlers. Indicates potential persistence mechanism registration.
tags:
- attack.persistence
- attack.t1546
logsource:
  category: file_event
  product: macos
detection:
  selection:
    TargetFilename|contains:
    - LaunchServices
    - com.apple.LaunchServices
    TargetFilename|endswith:
    - .csstore
    - .cache
  filter_installer:
    Image|contains:
    - /Install
    - /Installer
    - /Helper
  filter_system:
    Image|contains:
    - /System/
    - /Library/CoreServices/
  condition: selection and not (filter_installer or filter_system)
falsepositives:
- Legitimate application installation or first-run setup updating LaunchServices cache
- macOS system updates or Spotlight re-indexing activities
level: low
id: 8ea19548-ec9e-533e-9768-fefff4fc0402
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x12.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free