AdLoad is a long-running macOS adware loader, around since at least 2017, that comes bundled with downloads from unofficial sites and then hijacks your searches and injects ads. If your homepage or search engine changed on its own, remove extensions you didn't add and look for unfamiliar items in your LaunchAgents folders and Login Items.
Last reviewed · 2 sources
Also known as: Adload, AdLoad.BundleInstaller
AdLoad is one of the most widespread adware loaders on macOS and has been around since at least 2017 (SentinelLabs). It installs a persistence agent in your user LaunchAgents folder, hijacks browser searches and injects ads. In 2021 SentinelLabs found over 150 unique samples of a new AdLoad campaign that Apple's XProtect did not detect yet, some of them notarized by Apple. XProtect 5368 (macOS 26.5, checked October 29, 2026) carries several AdLoad signatures and an XProtect Remediator module named Adload.
Bundled with free software downloads from third-party sites
Fake Flash Player update prompts on compromised websites
Malvertising that redirects to fake download portals
Repackaged versions of popular utilities offered outside the App Store
Browser homepage or search engine changed without your permission
Ads on websites that normally have none
Files in ~/Library/LaunchAgents with names like com.ActivityInput.service or com.AnalyzerWindow.service, patterns SentinelLabs saw in 2021
Browser extensions you didn't install
Open System Settings › General › Device Management (Privacy & Security › Profiles on macOS 13) and remove any profile you didn't add yourself. Adware can use profiles to lock browser settings.
Check Safari, Chrome and Firefox for extensions you didn't add, remove them, and reset each browser's homepage and search engine.
Look in ~/Library/LaunchAgents, /Library/LaunchAgents and /Library/LaunchDaemons for plist files with random-looking or unfamiliar names, and remove the ones tied to the adware. With admin rights, AdLoad can install system-wide items as well.
Go to System Settings › Network › your connection › Details › Proxies and turn off any proxy you didn't set up.
CoreLock's free scan includes a startup-items check. Review what it lists, then remove anything you don't recognize yourself.
Avoid downloading software from unofficial or third-party websites
Flash Player is discontinued, so any prompt to install or update it is a lure
Keep automatic security updates on so XProtect gets new signatures
Read each installer screen and turn off offers you didn't ask for
What it can and can't do
AdLoad keeps itself running with items in your LaunchAgents folders, and startup items are one of the six checks in CoreLock's free scan. It can't promise to catch every AdLoad variant.
It's adware rather than a stealer, but it's more than an annoyance: it hijacks your searches, injects ads into pages you visit and keeps itself running through launch items, and as a loader it can fetch more software.
Deleting the visible app isn't enough. SentinelLabs found AdLoad installs a persistence agent in your user LaunchAgents folder with or without admin rights, and more when an installer was given admin rights. Remove every launch item it added, along with its extensions and any profile.
Often, but not always first. In 2021 SentinelLabs found over 150 unique AdLoad samples that XProtect didn't detect yet. XProtect 5368 (macOS 26.5, checked October 29, 2026) now has AdLoad signatures and an XProtect Remediator module named Adload, which scans for it in the background.
Free, with no account: the scan checks your Downloads folder against a built-in malware-hash list and 19 YARA rules.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser