Clean a Mac from adware that opens sponsored tabs

How to clean a Mac from adware that opens a new tab with sponsored content on every click requires identifying where the redirects originate. A rogue extension, changed homepage or search engine, and unwanted app can all create the pattern. A normal advertisement does not usually take over every link, so persistent redirects call for systematic removal rather than another ad blocker.

Work in a controlled order: protect your data, remove the source, rebuild the browser profile and verify the Mac stays clean. Avoid popup “Mac cleaner” offers made by the redirects. ACCC Scamwatch has documented fake security products targeting Australians, while the Australian Cyber Security Centre (ACSC) publishes current guidance for macOS and account security.

Recognise the hijacking pattern

Open the affected site in a normal browser window, then compare it with a private or incognito window. If the redirect vanishes in private mode, focus on extensions, website data and the browser profile. If it appears in both, continue checking downloaded apps, system profiles and network settings.

Visit a harmless, well-known site instead of the promoted pages. Sponsored ads may imitate familiar Australian brands such as Bunnings or Telstra, but the imitation itself is not proof of malware. Record which browser, profile and network reproduce the redirect before making changes.

Back up and contain the problem

Quit the affected browsers and disconnect from Wi-Fi if an unknown app is still downloading files. Copy important documents to Time Machine or an external drive, but do not preserve suspicious installers or browser profiles. Disconnecting the Mac prevents fresh downloads while you work.

Change important account passwords from a trusted browser, enable multifactor authentication and check for unwanted mail rules or password changes. If security warnings were disabled, follow removing a security-disabling trojan before restoring protective settings; manually turning protection back on may conceal an active compromise.

Remove extensions and enforced policies

In Safari, open Settings, then Extensions; older macOS versions call this Preferences. In Chrome, open the three-dot menu, choose Extensions and review Manage Extensions. Remove unfamiliar items, especially those added recently with access to all websites or the ability to read browsing history. Keep only extensions from publishers you can verify.

A “managed by your organisation” message or enforced homepage may reflect a policy profile. Check System Settings, then General, Device Management or Profiles. Do not delete a legitimate corporate profile on a work-managed Mac used in a Sydney or Melbourne office; ask the employer’s IT team and also check for any second, unauthorised profile.

Delete unwanted apps and persistent items

Sort Applications by Date Added and inspect both /Applications and the user’s ~/Applications folder. Uninstall unfamiliar programs with their own uninstaller, then open System Settings, General and Login Items & Extensions to remove suspicious helpers. Avoid deleting Apple components or random system files.

Review Device Management or Profiles for unfamiliar configuration profiles that install browser policies or background services. If the Mac has unexplained sustained processor use or cryptocurrency-mining activity, use the targeted cryptocurrency-miner cleanup process rather than assuming a browser reset is enough. Never weaken Gatekeeper or System Integrity Protection to remove an item.

Rebuild the affected browser profile

Confirm that bookmarks and passwords are synced or exported, then use Safari’s Reset or Restore Defaults option and Chrome’s Restore settings to original defaults. Clear suspicious website data and recheck the homepage, default search engine, startup pages and pop-up settings. Resetting can sign you out of websites, but it should not require discarding saved passwords.

If Chrome still redirects, move it to Trash, empty the Trash and reinstall it only from Google’s official site or the Mac App Store. Add extensions only after the clean profile is confirmed. Safari is integrated with macOS, so use its built-in reset rather than deleting system files by hand. Do not download a replacement browser from an ad shown by the hijacker.

Scan the Mac and related devices

Let macOS update itself and keep XProtect current, then use one reputable, independently reviewed scanner obtained directly from its developer. Follow its findings and quarantine confirmed unwanted items. Any genuine software purchased from an Australian business must meet the consumer guarantees in the Australian Consumer Law, while a popup demanding payment for “removal” is not a trustworthy scanner.

If a Windows computer shares the same Australian home or office network, run the documented secondary malware scan there as well, because a downloaded Windows trojan can spread back to the Mac. If every browser on the Mac is affected, compare macOS Wi-Fi DNS settings with the defaults supplied by Telstra, Optus or iiNet and check for unauthorised proxy or DNS entries.

Verify the fix and prevent recurrence

Use this verification checklist after each cleanup stage:

• Reload a known site in normal and private browsing modes.
• Reopen the browser and confirm the homepage and search engine stay unchanged.
• Check Extensions, Login Items and Applications for anything that has returned.

Then apply this prevention routine:

• Update macOS and browsers promptly, following ACSC alerts.
• Install software only from the Mac App Store or the developer’s official domain.
• Decline unexpected extension, profile and notification permission requests.

Area	Localised symptom	Wider symptom
Browser	Only one profile redirects	Every profile or browser redirects
Persistence	One extension or login item returns	Unknown profiles, apps or DNS entries reappear
Response	A browser reset resolves it	The redirect returns after restart or across devices

A clean result means ordinary links no longer redirect, startup pages remain unchanged and no unknown item comes back after a restart. Keep the quarantine record and installed-version notes, because that evidence makes any later recurrence easier to trace.