Loading malware…
Mac File Opener is macOS malware associated with the PCVARK ecosystem of deceptive Mac applications and distributed as part of an Advanced Mac Cleaner installation chain. It is detected by some vendors as OSX.FakeFileOpener. Rather than relying on conventional persistence mechanisms such as login items, launch agents, or launch daemons, it abuses macOS Launch Services by registering itself as a handler for a very large number of document types through the CFBundleDocumentTypes mechanism. This causes the operating system to launch the application when a user attempts to open a file type for which no other handler is registered, providing a stealthy execution method that can evade security tools focused on traditional persistence artifacts.
The malware defines hundreds of file associations, including both common and obscure extensions, increasing the likelihood that it will be invoked during normal user activity. Once launched in response to an unsupported file-opening attempt, it presents a fake macOS-style dialog that imitates legitimate system behavior while removing or replacing normal options. The dialog steers the victim toward a web search flow that redirects to scam pages claiming the file-opening problem may be caused by malware infection. Those pages promote additional unwanted or deceptive Mac software, including other products linked to the same operator.
Mac File Opener is notable for combining social engineering with abuse of native macOS application-registration behavior. It has been linked to Techyutils Software Private Limited and PCVARK, with code and branding overlaps indicating common operation. The malware targets macOS users and fits a broader pattern of deceptive utility and scareware campaigns aimed at driving installation of unwanted software through fake alerts and misleading remediation prompts.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
We consider Mac File Opener to be malware, and Malwarebytes Anti-Malware for Mac will detect it as OSX.FakeFileOpener.
We consider Mac File Opener to be malware, and Malwarebytes Anti-Malware for Mac will detect it as OSX.FakeFileOpener.
5 distinct techniques documented for this family, organized by ATT&CK tactic.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Adware cited as background research because it abused macOS document handlers for persistence; not part of the WINDSHIFT malware campaign itself.
Mac File Opener is a piece of adware targeting macOS systems. It is notable for its novel persistence technique: it registers itself as a 'document handler' for over 200 file types via its Info.plist file. This means that if a user attempts to open a file type for which no other handler is registered, the OS will launch Mac File Opener, thereby executing the malware. This method allows it to bypass some security tools that only monitor for traditional persistence mechanisms.
A malicious Mac application that registers itself to open a very large number of file types, intercepts attempts to open unsupported files, displays a fake error dialog, and redirects users to scam pages that push unwanted software such as fake cleaners and removers.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.