Mac Security · Mac Malware: Myth vs Reality · Lesson 3 of 5

Adware and Browser Hijackers on a Mac

Spot changed search engines, sneaky extensions and profiles, then clean them up.

Signs of adware and hijackers

Adware is unwanted software that fills your screen with ads. A browser hijacker is its close cousin. It takes over your web browser's settings so your searches go where it wants.

These are some of the most common unwanted programs on Macs. They're usually less harmful than info-stealers. But they track what you do, show you scam ads and can lead you to worse downloads.

They often arrive bundled with something else. You install a free video converter, and an extra "search helper" quietly comes along. Fake update pop-ups, like the one earlier in this course, are another way in.

Signs to look for:

• Your searches land on a search site you've never heard of.
• Your homepage, the page that opens when you start the browser, is now a strange site.
• Pop-ups appear on sites that never had them.
• New extensions you don't remember adding. An extension is a small add-on that gives a browser extra features.
• Your browser opens new tabs or windows by itself.

Apple notes that if you've blocked pop-ups for a website and still see them, you might have unwanted software on your Mac.

Here's how to check Safari. Open Safari, then choose Safari › Settings from the menu bar.

• Click Search to see which search engine Safari uses. Change it back to the one you want.
• Click General to see the homepage. Fix it if it's wrong.
• Click Extensions to see every extension. Turn off any you don't recognize.

In Chrome, Edge or Firefox, open that browser's Settings and look for Search engine, On startup (or Home) and Extensions.

Profiles and cleaning up

Some hijackers go one step further. They install a configuration profile. A profile is a file that sets rules on your Mac. Schools and companies use them to manage their computers, for example to set up Wi-Fi or lock certain settings.

Adware can misuse a profile to lock your browser's homepage or search engine. You change it back, and it flips again. That's a big clue.

To check on recent versions of macOS, open System Settings, click General, then Device Management. You may need to scroll down. On macOS Ventura, look in Privacy & Security › Profiles instead. On a personal Mac, there are usually no profiles at all.

If you find a profile you don't recognize, select it and click the remove button, a minus sign. First ask yourself: is this a work or school Mac? If so, the profile may be needed, so ask your IT team instead. Apple says some profiles can only be removed by the Mac's administrator.

Clean-up steps, in order:

1. Remove unknown profiles.
2. In Safari › Settings › Extensions, select each unknown extension and click Uninstall.
3. Fix your search engine and homepage.
4. Open Applications in Finder. Drag apps you didn't mean to install to the Trash.
5. Check System Settings › General › Login Items & Extensions, and turn off anything strange.
6. Restart, then check that your fixes stuck.

Be careful with "Mac cleaner" apps you find through ads or pop-ups. Some are adware themselves, and some exist only to scare you into paying. If you want a second opinion, choose an app from a well-known security company, downloaded from the App Store or its own website.