How to Remove a Browser Hijacker That Creates Fake Bookmarks

Fake bookmarks can appear suddenly and point to suspicious shopping sites, fake search engines, adult pages or misleading technical-support offers. A browser hijacker that creates fake bookmarks often changes more than the bookmark list. It may also alter the homepage, default search engine, new-tab page and browser extensions. Removing only the visible links can leave the underlying redirection active.

The unwanted program may be a rogue extension, a browser profile modification, an installed application or, less commonly, spyware. Behaviour differs between Chrome, Edge, Firefox and Safari, but the cleanup process follows a similar sequence: isolate the cause, remove it, restore controlled settings and verify that the changes remain after a restart.

Start on the device showing the problem and avoid signing into sensitive accounts until it has been checked. A browser used on public Wi-Fi at a Melbourne café, Brisbane library or Sydney airport deserves particular attention because several extensions, downloads or profile changes may have accumulated over time.

Recognise the hijacking symptoms

Typical signs include unfamiliar bookmark folders, constant redirects, altered search results, new toolbar icons, unsolicited notifications and a homepage that resets after you change it. Fake bookmark names may look plausible, but their destinations often contain mistyped domains, excessive advertising parameters or unrelated affiliate pages.

Record what has changed before deleting anything. Note the browser, affected profile, suspicious bookmarks, extension permissions and homepage settings. Also check another browser on the same device; if the problem stays inside one browser profile, an extension or stored browser preference is more likely than a full system infection.

Remove the responsible extension

In Chrome, open chrome://extensions; in Edge, use edge://extensions; in Firefox, select the puzzle-piece icon and open Add-ons Manager; in Safari, visit Safari Settings and open Extensions. Review recently installed items, unfamiliar publishers, broad site permissions and anything enabled in private browsing.

Disable a suspicious extension first and test the browser. If redirects and fake bookmarks disappear, remove it completely, including any companion extension it installed. Do not remove an item labelled as managed by an organisation without checking with an administrator, because policy-controlled settings may restore themselves.

Security alerts often name the application or extension responsible for the behaviour. Reviewing current malware security news can help distinguish a known malicious package from a legitimate browser feature, although generic advice should never replace checking the actual permissions and files involved.

Reset search, homepage and bookmarks

Restore the homepage and default search engine through the browser’s search settings. Remove every unwanted bookmark and empty the bookmark folder’s deleted items. Inspect other folders because hijackers may hide entries inside a generic toolbar, favourites or imported bookmarks area.

Browser synchronisation can restore removed items from another device. Review synced bookmark changes, sign out unexpected devices and pause synchronisation temporarily while cleaning the affected profile. If the same folders reappear, the source is still active or another synced device is reinstalling the unwanted extension.

Clear cached files, cookies and site data for the affected browser after preserving any information you need. This may sign you out of websites and reset some site preferences, so use the browser’s targeted controls rather than wiping all local data without checking what will be lost.

Check startup items and browser policies

Open the current tabs, startup pages and application settings to see whether an unfamiliar URL has been added. Review homepage, new-tab and search-engine sections for changes that were not made by you. An extension with permission to manage your browser can redirect searches even after the visible bookmark entries are deleted.

Built-in reset options can remove extensions, cookies and startup changes in Chrome, Edge and Firefox. Use them when manual cleanup fails, but export only bookmarks you recognise as legitimate. If the browser is managed by a school or workplace, ask the administrator to inspect its policies rather than attempting to bypass them.

Clean the operating system and test for spyware

On Windows, check Installed Apps for unfamiliar browser tools, redirectors or programs installed recently without permission. Run Microsoft Defender’s standard scan and then its Offline Scan. On a Mac, review Applications and Login Items or Extensions under System Settings, then use a reputable security tool if Defender-equivalent checks reveal persistent activity. Do not delete unknown macOS or Windows system components.

Also examine notification, search and homepage permissions granted to applications. Persistent redirects can come from a background program rather than the browser itself. If browser cleanup alone does not stop the behaviour, the system scan becomes essential.

Unexpected camera prompts or activity require separate attention from bookmark changes. This guide to webcam tracking spyware explains how to identify unauthorised webcam access, check browser permissions and investigate a camera indicator that activates without an expected session.

Recover accounts and strengthen routine protection

Change passwords entered through a suspicious page, revoke active sessions and enable multi-factor authentication for email, banking and cloud storage. Update the operating system and browser, then choose a current, reputable antivirus product. Some Australian broadband and device-security offers from providers such as Telstra or Optus include managed protection, but a subscription should not be mistaken for permission to keep an unknown browser extension installed.

ACCC and Scamwatch guidance is particularly relevant because fake bookmarks frequently lead to payment-request scams and fraudulent tech-support sites. Australian privacy expectations are also shaped by the Privacy Act and OAIC guidance, so unexpected camera, microphone or browsing permissions should be investigated rather than accepted automatically.

Verify the cleanup and compare browser controls

Test the affected browser in a normal window and a private window, visit a familiar search engine and confirm that the homepage remains unchanged. The browser’s internal controls determine where suspicious extensions, search settings and bookmarks are exposed.

Browser	Extension controls	Search and homepage controls	Bookmark location
Chrome	chrome://extensions	chrome://settings/search	Bookmark manager
Edge	edge://extensions	edge://settings/search	Favorites and Favorites bar
Firefox	Add-ons Manager	Settings, Search	Bookmarks toolbar and menu
Safari	Safari Settings, Extensions	Safari Settings, Search	Bookmarks menu and sidebar

Restart the device and repeat these checks after synchronisation has completed. The finished state is a clean browser profile, restored search and homepage settings, no unexplained bookmark folders and no recurrence of the redirects after an update or reboot.