Mac File Opener adware abuses document handlers

PublishedThe source gives no date · added 2 August 2026 Vorant ratingroutine threat

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Adware called 'Mac File Opener' abuses macOS's Launch Services document-handler registration to gain execution without a traditional persistence mechanism.

Sourceobjective-see.org — open the original

What to check

Applies to: Whether this concerns you is not assessed; the names the report mentions are listed below.
Date: The source gives no publication date; the date shown is the day Vorant added the brief.

This technical writeup from Objective-See dissects a piece of OS X adware, dubbed 'Mac File Opener' and bundled inside an 'Advanced Mac Cleaner' installer, first identified by Malwarebytes researcher Thomas Reed. Rather than installing a login item, launch agent, or launch daemon, the malware registers itself in its Info.plist as a 'document handler' for over 200 file types via the CFBundleDocumentTypes key. When a user opens a file of one of these types (and no other app is already registered as the handler), macOS's Launch Services automatically executes the malware.

The author reverse-engineers the underlying OS mechanics, tracing how the lsd daemon parses an application's Info.plist upon its arrival on disk, extracts CFBundleDocumentTypes entries, and persists them to a Launch Services database (a .csstore file) via internal LaunchServices framework calls such as _LSCreateRegistrationData, LSBundleRecordBuilder::registerBundleRecord, and _LSRegisterDocumentTypes. At runtime, when a user opens a matching file, Finder/LaunchServices resolves the registered handler through _LSBundleCopyOrCheckNode and launches the malicious app via spawn_via_launchd.

While this is an 'unreliable' persistence technique requiring user interaction, it notably bypasses monitoring tools (like BlockBlock) that watch for traditional autostart mechanisms. The malware sample was also signed with a legitimate Apple Developer ID belonging to 'Techyutils Software Private Limited,' allowing it to pass Gatekeeper checks. The piece is primarily a research/technical deep-dive rather than an active-campaign alert, and closes with the author considering whether security tools like KnockKnock should surface document-handler registrations as a monitored technique.

Mentioned in this report

Malware Mac File Opener

Detection guidance

Modification of LaunchServices Database for Document Handler Registration

ATT&CK T1546 · status experimental · needs macos file_event logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects modifications to LaunchServices .csstore database files and registration cache, which occur when an application registers itself as a handler for file types. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Modification of LaunchServices Database for Document Handler Registration
description: Detects writes to LaunchServices database files (.csstore, plist caches)
  in user or system Library directories, which are modified when applications register
  themselves as document handlers. Indicates potential persistence mechanism registration.
tags:
- attack.persistence
- attack.t1546
logsource:
  category: file_event
  product: macos
detection:
  selection:
    TargetFilename|contains:
    - LaunchServices
    - com.apple.LaunchServices
    TargetFilename|endswith:
    - .csstore
    - .cache
  filter_installer:
    Image|contains:
    - /Install
    - /Installer
    - /Helper
  filter_system:
    Image|contains:
    - /System/
    - /Library/CoreServices/
  condition: selection and not (filter_installer or filter_system)
falsepositives:
- Legitimate application installation or first-run setup updating LaunchServices cache
- macOS system updates or Spotlight re-indexing activities
level: low
id: 8ea19548-ec9e-533e-9768-fefff4fc0402
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x12.html

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account What it costs