Users of Windows or macOS who have installed Adobe Creative Cloud may discover unexpected entries in their system’s hosts file. The company silently injects several DNS mappings that point to a detection endpoint on adobe.com. When a browser loads the page, a tiny image request to https://detect-ccd.creativecloud.adobe.com/cc.png either succeeds or fails, revealing whether Creative Cloud is present on the machine.

Originally the check queried http://localhost on a range of ports, letting the local Creative Cloud client respond directly. Chrome’s recent restrictions on local‑network access broke that flow, prompting Adobe to fall back on the hosts‑file trick. By forcing DNS resolution to their server, the script can infer installation status without any user‑visible prompt or notification for the user anyway.

Security researchers on Reddit flagged the behavior as bordering on malware, arguing that silently altering a core OS file to harvest telemetry crosses an ethical line. While the technique achieves its goal, it also opens a vector for abuse if other software hijacks the same entries. Users can remove the lines manually, but the practice highlights a growing tension between convenience features and user control.