Maxthon is a web browser that was found to share users' data with Chinese developers

Maxthon — a browser that is presented as “the most secure browser on the web without viruses and malware.” However, it has been added to the category of the potentially unwanted programs (PUPs)[1] due to its privacy-related issues. When conducting the analysis, experts also found that the virus creates a ueipdat.zip file on the infected computer which regularly sends the collected data to China, where the Maxthon’s servers are located.[2] The ZIP file itself contains another document called dat.txt which requires a passcode to view it since the file is encrypted. Even when the browser is manually disabled, it remains persistent on the device and still connects to the server where tracked data is sent continuously. Due to that, we recommend you to get rid of Maxton browser completely.
| Name | Maxthon |
|---|---|
| Type | Browser/extension |
| Category | Potentially unwanted program |
| OS | Windows, Mac |
| Main danger | Collects various data about the user and sends it to China-based servers |
| Promoted as | Secure and fast web browser |
| Distribution technique | The official website, third party sites |
| Fix | Use FortectIntego to double check the system and make sure that it is virus-free |
Since the day Maxthon cloud browser was released, security experts and PC users have been discussing its trustworthiness. According to the researchers from SemVirus[3], the most questionable feature of this browser is data tracking. Of course, legitimate browsers (Google, Firefox, etc.) can also be used for collecting various information about their users. However, there is no risk that they could overstep the acceptable level.
Maxthon, on the other hand, collects all sorts of hardware and software information. The collected data includes the current version of the OS, CPU type, and speed, screen resolution, browsing history, the status of your ad blocker and many other details that are non-personally identifiable, but useful if the malicious parties decide to involve you in online marketing. All this data tracking is disclosed in the Privacy section of the official website that states:
Maxthon is a global company and our computers/servers are located in several different places around the world. We also use service providers whose computers may also be in various countries. This means that your information might end up on one of those computers in another country, and that country may have a different level of data protection regulation than yours. By giving us information, you consent to this kind of transfer of your information. No matter what country your information is in, we comply with applicable law and will also abide by the commitments we make in this privacy policy.
Based on this information and questionable content that it delivers, the browser has been actively called as Maxthon virus. As it was discovered, the web browser sends ZIP files to servers in China. Information is sent no matter if the user disabled the feature of data sharing or not, unfortunately.
There are various versions of this browser and tons of different variants compatible with all existing OS's:
- Maxthon for XP;
- Maxthon for Android;
- Maxthon for Mac;
- Maxthon for Linux;
- and so on.
Maxthon Cloud Browser can also be found in various third-party sites online that present it as a useful product. However, note that getting something from a suspicious source can put the security of your device at high risk of getting cyber infections.[4] You need to uninstall the browser and related extensions if you doubt that this is useful for you. If you still want to use this browser choose the official distributor and reinstall the tool.
Legitimate and acknowledged browsers would not involve in data gathering and exploitation. So, remove Maxthon from your computer by following the guide below. This will ensure that your device is not at risk and keeps your information safe. You can also clean the system using FortectIntego after the process to fix any possible damage.

Maxthon Cloud Browser data tracking activities
The computer analyst managed to bypass this AES-128-ECB encryption[5] by extracting the passcode from the Maxthon browser's binary. It was found that this is exactly where all the aforementioned data is stored. In the meanwhile, the representatives of the company blame it all on the users and claim that the data gathering can be opted out in the browser’s settings.
Unfortunately, it is not what happens. Even after these settings are disabled the browser does not cease to send the information to predetermined services. Thus, the users who value their privacy are left with one option only, and that is one of the reasons you need to proceed with Maxthon removal. However, this is still a legitimate and popular browser, so don't treat it as malware uninstall the program instead.
Maxthon Update Tool causing more problems
Maxthon Update Tool is a component of the third version of Maxthon. However, it’s a browser’s vulnerability which might be exploited by cyber-criminals. The issue might be solved with the current version, of the browser.
Attackers might use Maxthon tool for various purposes. For instance, this vulnerability might allow installation of various tracking technologies to steal sensitive information. The browser might also display malware-laden ads or redirect to potentially dangerous websites
So-called Maxthon Update Tool virus does not create a tray icon and does not appear in the system tray. However, it runs under the parent process C:\Program Files\Maxthon3\Bin\MxUp.exe and takes 77.3 Kb of the disk space. Therefore, to detect the virus might not be easy.
However, Maxthon tool is associated with the browser itself. Therefore, to avoid potential threats or browsing-related problems, you should get rid of any suspicious program as soon as possible. We highly recommend relying on “traditional” and well-known web browsers, such as Google Chrome or Mozilla Firefox.

Stay away from questionable websites
You can obtain this browser directly from its official website, file download sites or through peer-to-peer file sharing platforms. Since it is promoted as an innovative and useful application, it does not lack direct downloads, but cybercriminals still use shady software distribution techniques such as “bundling” to spread questionable tools.
This method allows the program to be delivered on the users’ computers along with other free applications. And the users do not even have to know the hijack has even occurred. Using the “Quick” or “Recommended” installation settings of the initially downloaded program, they automatically allow the potentially unwanted app to enter the computer.
After that, the shortcut to this browser simply appears on the desktop, and the user can start using it. To prevent such involuntary installs, you should always opt for the “Advanced” or “Custom” setup and opt out undesirable programs. Choose reputable sites and read Privacy Policy on the page to make sure that the provider is legitimate.
Remove Maxthon from your device and scan the system to see if there any damage
You shouldn't treat this browser or associated tools as malicious programs. There is the quickest and the most guaranteed Maxthon removal method – uninstallation. You can uninstall the browser, extensions, and other related tools or applications safely.
However, if you are one of those people that need to make sure that uninstall worked on every element of the suspicious program. You can remove Maxthon from the system with steps below the article and then scan the machine with PC repair tool.
Uninstall from Windows
Uninstall from Windows 10/8:
- Type Control Panel into the Windows search box and open the result.
- Under Programs, select Uninstall a program.

Uninstall from Windows 7/XP:
- Click on Windows Start > Control Panel (Windows XP users should click on Add/Remove Programs).
- In Control Panel, select Programs > Uninstall a program.

Remove the unwanted program:
- In the Programs and Features window, look for any recently installed suspicious entries, select them, and click Uninstall.
- If User Account Control appears, click Yes to confirm, then complete the removal.

Delete from macOS
Remove the unwanted application:
- From the menu bar, select Go > Applications.
- In the Applications folder, look for any suspicious entries, then drag them to Trash (or right-click and pick Move to Trash).

Delete leftover files and folders:
- Select Go > Go to Folder.
- Enter /Library/Application Support and remove any suspicious folders related to the unwanted program.
- Repeat the same check in the /Library/LaunchAgents and /Library/LaunchDaemons folders, deleting any suspicious entries.

- Finally, empty the Trash to permanently remove the leftovers.
Did this guide help?
1 comment
Alberto
Its not legitimate for sure! Its a pure tracking machine!