# Mac File Opener adware abuses document handlers

Published: 2026-08-02 · Severity: low
Canonical: https://vorant.io/reports/ad3dd5d0-147e-5c6a-9a17-8584abe5b3fd/mac-file-opener-adware-abuses-document-handlers

> Adware called 'Mac File Opener' abuses macOS's Launch Services document-handler registration to gain execution without a traditional persistence mechanism.

This technical writeup from Objective-See dissects a piece of OS X adware, dubbed 'Mac File Opener' and bundled inside an 'Advanced Mac Cleaner' installer, first identified by Malwarebytes researcher Thomas Reed. Rather than installing a login item, launch agent, or launch daemon, the malware registers itself in its Info.plist as a 'document handler' for over 200 file types via the CFBundleDocumentTypes key. When a user opens a file of one of these types (and no other app is already registered as the handler), macOS's Launch Services automatically executes the malware.

The author reverse-engineers the underlying OS mechanics, tracing how the lsd daemon parses an application's Info.plist upon its arrival on disk, extracts CFBundleDocumentTypes entries, and persists them to a Launch Services database (a .csstore file) via internal LaunchServices framework calls such as _LSCreateRegistrationData, LSBundleRecordBuilder::registerBundleRecord, and _LSRegisterDocumentTypes. At runtime, when a user opens a matching file, Finder/LaunchServices resolves the registered handler through _LSBundleCopyOrCheckNode and launches the malicious app via spawn_via_launchd.

While this is an 'unreliable' persistence technique requiring user interaction, it notably bypasses monitoring tools (like BlockBlock) that watch for traditional autostart mechanisms. The malware sample was also signed with a legitimate Apple Developer ID belonging to 'Techyutils Software Private Limited,' allowing it to pass Gatekeeper checks. The piece is primarily a research/technical deep-dive rather than an active-campaign alert, and closes with the author considering whether security tools like KnockKnock should surface document-handler registrations as a monitored technique.

## Mentioned in this report

- Malware: Mac File Opener

Source reporting: https://objective-see.org/blog/blog_0x12.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/ad3dd5d0-147e-5c6a-9a17-8584abe5b3fd/mac-file-opener-adware-abuses-document-handlers.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup