Downloaded PDFs not opening due to possible malware

Looks like a weird Gatekeeper bug for certain applications if you change defaults in Finder. Documents will open fine if opened in a downloaded application, but right-clicking, choosing Open With -> Other (and/or then choosing Always Open With) will cause Gatekeeper to activate and fail to open the file. Even if you open your own created file on the computer.

Steps to repro:

• Install an app from the web like LibreOffice
• Create a csv file (Mac defaults to Numbers) using an app that was not part of the OS nor downloaded from the App Store to ensure xattr data is written that probably causes it not trust the file
• Open the csv file from Finder, it will open fine in Numbers
• Close Numbers
• Right click the file and change the default app to LibreOffice
• File will suddenly be "malware"
• Change default app back to Numbers, or manually approve that file in System Settings and the computer suddenly thinks the file is fine again

It seems spctl used to have flags to whitelist apps to make this go away, to just mass-flag everything in /Applications/ as valid, but those features were obsoleted (even though the man page says deprecated) so spctl --add and spctl --enable are both non-functional and can't be used to fix it. Probably also what's causing the bug on Finder side.

spctl scan of a file I created on my computer and has no reason to fail:

% sudo spctl -a ~/Desktop/file.csv
/Users/username/Desktop/file.csv: rejected

Something Apple will have to fix.

frustrated_macbook_user_1 wrote:

I'm having the same issue. I'm trying to open PDF's from Dropbox and Sharepoint, and I get the same error message. Maybe it has something to do with the most recent MacOS update?

I would venture to guess that it has more to do with the source of those PDF files. Sharepoint is part of the Microsoft Windows ecosystem. Filed placed there could be from infected PCs which are more prone to malware.

This has nothing to do with malware. It's a Gatekeeper and sandbox problem. I think the cause is downloading a PDF using a sandboxed, possibly Mac App Store app. The documents that the app creates are sandboxed and can't be double-clicked in the Finder. You can open them from within another app using File > Open.

I'm having a similar problem in that I can open certain df files when working on the computer on which they are stored, but not when working on other computers on the network. Copying the files to the other computers does not make them openable on those computers.

BeamQueen82 wrote:

All of a sudden I can't easily open PDFs. I get this message:

Apple could not verify “document name” is free of malware that may harm your Mac or compromise your privacy.

I know the files are safe. I have to go and allow in settings every time I want to open these files. It doesn't work with any PDF reader and I prefer Preview.

This has only just started and my previous downloads work.

Downloaded from where...

seems odd— Can you Control click on the —>Open

Can you supply a link to one of your problem PDF and I'll check it here on my macOS 15.2 ...(?)

what about this example: https://help.apple.com/pdf/security/en_US/apple-platform-security-guide.pdf

Switch to Preview as the default app, and check again.

From Terminal, post the file protections and attributes:

ls -ale@ filename.pdf

I am having a similar problem. I can't open any PDFs, even ones that I created on this computer by printing from a Word document (that I created) to PDF. I keep getting a malware error and a prompt to delete the files, even though I know they are safe since I created them.

It is ridiculous that I need to type in my password and click three buttons to open a file I made entirely on this computer. It's interfering with my work that I can't open PDFs easily. Are there any workarounds??

John Link wrote:

I'm having a similar problem in that I can open certain df files when working on the computer on which they are stored, but not when working on other computers on the network. Copying the files to the other computers does not make them openable on those computers.

Which PDF reader app is in use?

Are there any add-on anti-malware apps around?

Which PDF tool is set to open these PDF files, as shown in the Get Info details for the PDF?

I am also having this issue. I basically cannot use my Mac the way I used to. Issues like this --issues that relate to such simple everyday needs- happen a lot and the Apple devs seem disinterested in solving them, so that Mac users had to go through so many hoops, intricate solutions that they know nothing about and make their OS practically unusable Just Because the OS is so protective of our safety. Meh....

I'm having the same issue. I'm trying to open PDF's from Dropbox and Sharepoint, and I get the same error message. Maybe it has something to do with the most recent MacOS update?

The vast majority of PDF files are fine.

There is, however, a PDF around that plays the game Doom.

Yes, PDFs can contain code.

Both Acrobat and Preview fail to open certain PDF files.

Malwarebytes is installed on all computers.

Get Info shows Acrobat as the default application.