How to Fix a Browser Hijack on Apple Safari

Introduction

Browser hijacking or 'pop-up phishing' involves fraudulent messages that unexpectedly pop up for users when they are surfing the web. In many cases, cyber criminals infect otherwise legitimate websites with malicious code that causes these messages to appear when people visit them.
The content of these messages themselves is what makes them so effective. Often, they present the unsuspecting website visitor with some kind of fraudulent warning from a well-known reputable company, typically about the security of their computer. Then they either prompt the visitor to download some tool to fix the problem, such as an antivirus application which turns out to be malware itself, or to call a fraudulent phone number for "support." The abnormal behavior of the message itself and the inability to close or navigate away from them, makes the fraudulent messages appear to be somewhat credible.
This guide will demonstrate how to rid yourself of the worrisome pop-up message, and then perform some simple operations to get Apple Safari back to normal.
A safari hijack

1 Force Quit Safari

  1. Select the Apple menu, then Force Quit.
    Apple menu with Force Quit highlighted.
  2. Highlight Safari in the list, and select Force Quit.
    Force Quit dialog with Safari and Force Quit button highlighted.
  3. You'll be prompted if you're sure, select Force Quit.
    Force Quit conformation with Force Quit highlighted.

2 Check Homepage Settings

Your web browser's homepage settings dictate the websites that are loaded when it is opened up.

Safari

  1. From the (1) Safari menu, choose (2) Preferences.
    Safari with Safari menu and Preferences highlighted. Screenshot
  2. Click on (1) General. Type in the (2) Homepage address that you want.
    Safari General menu with Homepage highlighted. Screenshot

3 Remove Extensions

Extensions provide extra features to Safari. Sometimes, these Extensions are not coded well, break after an update, or they change the way Safari works in a malicious way to show you advertisements.

Disabling or removing unneeded or unwanted Extensions can help resolve these problems.

Some pop-ups are created from extensions and add-ons installed on your browser. We will be going over steps to remove the extension.

Apple Safari.

  1. From the Safari menu, choose Preferences.
    Safari with Safari menu and Preferences highlighted. Screenshot
  2. The following steps can be repeated to remove multiple browser extensions.
    • Click the Extensions tab. Click on Uninstall for any extensions you want to remove.
      Extensions menu with Uninstall highlighted. Screenshot
    • You will get a confirmation window.  Click on Uninstall to confirm removal.
      Confirmation window with Uninstall highlighted. Screenshot
    • If a new tab opens up, you can close it by hitting the X.
  3. Extensions are now gone, you may have to restart your browser for it to take effect. If you removed a malicious extension, it might have changed your homepage.

4 Clear Browser History

  1. Open Safari.
    Apple Safari.
  2. Select the Safari menu, then select Clear History.
    Safari menu with Clear History highlighted.
  3. Select Clear all history, then select Clear History.
    Clear history dialog with Clear All History and Clear History button highlighted.

5 Test Search Page

  1. Open your browser and take note if it shows your normal home page or search page.
    Apple Safari.
  2. Test your ability to search the web like you normally would.

? Test your browser - have things returned to normal?

  1. Yes, things are normal now
  2. No, Safari still isn't right

We're here to help!

Connect to a Tech Pro

Call or chat with a Tech Pro 24/7.

Browser hijacking or 'pop-up phishing' involves fraudulent messages that unexpectedly pop up for users when they are surfing the web. In many cases, cyber criminals infect otherwise legitimate websites with malicious code that causes these messages to appear when people visit them.
The content of these messages themselves is what makes them so effective. Often, they present the unsuspecting website visitor with some kind of fraudulent warning from a well-known reputable company, typically about the security of their computer. Then they either prompt the visitor to download some tool to fix the problem, such as an antivirus application which turns out to be malware itself, or to call a fraudulent phone number for "support." The abnormal behavior of the message itself and the inability to close or navigate away from them, makes the fraudulent messages appear to be somewhat credible.
This guide will demonstrate how to rid yourself of the worrisome pop-up message, and then perform some simple operations to get Apple Safari back to normal.
A safari hijack
  1. Select the Apple menu, then Force Quit.
    Apple menu with Force Quit highlighted.
  2. Highlight Safari in the list, and select Force Quit.
    Force Quit dialog with Safari and Force Quit button highlighted.
  3. You'll be prompted if you're sure, select Force Quit.
    Force Quit conformation with Force Quit highlighted.

Your web browser's homepage settings dictate the websites that are loaded when it is opened up.

Safari

  1. From the (1) Safari menu, choose (2) Preferences.
    Safari with Safari menu and Preferences highlighted. Screenshot
  2. Click on (1) General. Type in the (2) Homepage address that you want.
    Safari General menu with Homepage highlighted. Screenshot

Extensions provide extra features to Safari. Sometimes, these Extensions are not coded well, break after an update, or they change the way Safari works in a malicious way to show you advertisements.

Disabling or removing unneeded or unwanted Extensions can help resolve these problems.

Some pop-ups are created from extensions and add-ons installed on your browser. We will be going over steps to remove the extension.

Apple Safari.

  1. From the Safari menu, choose Preferences.
    Safari with Safari menu and Preferences highlighted. Screenshot
  2. The following steps can be repeated to remove multiple browser extensions.
    • Click the Extensions tab. Click on Uninstall for any extensions you want to remove.
      Extensions menu with Uninstall highlighted. Screenshot
    • You will get a confirmation window.  Click on Uninstall to confirm removal.
      Confirmation window with Uninstall highlighted. Screenshot
    • If a new tab opens up, you can close it by hitting the X.
  3. Extensions are now gone, you may have to restart your browser for it to take effect. If you removed a malicious extension, it might have changed your homepage.
  1. Open Safari.
    Apple Safari.
  2. Select the Safari menu, then select Clear History.
    Safari menu with Clear History highlighted.
  3. Select Clear all history, then select Clear History.
    Clear history dialog with Clear All History and Clear History button highlighted.
  1. Open your browser and take note if it shows your normal home page or search page.
    Apple Safari.
  2. Test your ability to search the web like you normally would.

Potentially Unwanted Programs (PUPs)

PUPs, or "Potentially unwanted programs," often arrive bundled with your computer, or tag along with another software program you meant to install, but were part of a EULA or "Recommended Offer" you probably clicked right through. These are programs that don't really do anything good for you. Some of these programs can add unwanted browser toolbars that clutter your browser, track your web browsing, show additional advertisements, or change your search page and other related settings.
Example of a PUP installing a search bar

Removing an app may also remove all data for that app. Make sure you have any information you need backed up before removing an app for your Mac.

To Remove an App Installed from the App Store

  1. Open the Launchpad from the dock.
    Launchpad highlighted
  2. Click and hold on an icon until all icons start to jiggle.
    Shaking icon
  3. Click the "x" on the top left of the icon you want to remove.
    X highlighted
  4. Click Delete to confirm removal.
    Delete button highlighted

To Remove All Other Apps

  1. Open the Finder from the dock.
    Finder highlighted on the dock
  2. Click on Applications on the left.
    Application highlighted
  3. Drag the app you wish to remove to the trash can.
    Drag app to the trashcan
  4. Right click on the trashcan and click Empty Trash.
    Empty Trash highlighted
  1. From the menu bar across the top of the screen, select the Apple menu, then Restart...
    macOS Mojave Apple Menu with Restart highlighted.
  1. Open your browser and take note if it shows your normal home page or search page.
    • On a Desktop or Laptop, look for one of these icons:
      Main Desktop Browsers.
    • On a Smartphone or Tablet, look for one of these icons:
      Main Mobile Browsers.
  2. Make sure the page loads properly, and try following a few of the links from the page.
Unfortunately, your browser issue cannot be resolved via basic troubleshooting steps. Your machine will require hands-on service to determine the root cause of your issues.
We use cookies on our website to enhance your experience, analyze site usage and support our marketing efforts. To learn more, visit our Privacy Policy. By clicking “Accept”, you agree to our use of cookies and similar technologies.
Accept