Bundlore is macOS adware, in use since at least 2015, that rides along with free software in custom installers and adds browser extensions, search changes and other unwanted apps. If extra apps or extensions appeared after an install, remove them and reset your browser's homepage and search engine.
Last reviewed · 2 sources
Also known as: OSX.Bundlore, Bundlore Adware, SurfBuyer
MITRE ATT&CK describes Bundlore as macOS adware in use since at least 2015 that, though categorized as adware, has many features associated with more traditional backdoors. It arrives in custom installers that bundle unwanted programs, such as browser toolbars, search hijackers and ad-injecting extensions, with the software you meant to get. XProtect 5368 (macOS 26.5, checked October 29, 2026) includes Bundlore signatures and an XProtect Remediator module named Bundlore.
Custom installer wizards that bundle adware with free software
Fake software download portals that imitate legitimate sites
Download wrapper sites that add Bundlore to legitimate software
'Recommended' install options that are checked by default
A new browser toolbar or extension after a software download
Default search engine changed to an unfamiliar provider
A custom installer, rather than a standard macOS package, used for recent software
Several unwanted apps installed alongside the one you wanted
Check /Applications for programs you didn't mean to install. Bundlore installs more than one, so look for several unfamiliar apps added at the same time.
Check Safari, Chrome and Firefox for toolbars, extensions or search plugins you didn't add, and remove them.
Reset your homepage, default search engine and new tab page in every browser.
Check ~/Library/LaunchAgents for plist files from the bundled software and remove the ones created at the same time as the unwanted installs.
CoreLock's free scan checks startup items and compares files in your Downloads folder against a built-in malware-hash list and 19 YARA rules. Review browser extensions and settings yourself.
Choose Custom or Advanced install options and turn off bundled offers
Download software from the developer's own site, not wrapper or download portals
Read each installer screen for options that are checked by default
Keep automatic security updates on so XProtect stays current
What it can and can't do
Bundlore arrives as a downloaded installer and leaves launch items behind: CoreLock's free Downloads check compares files against a built-in malware-hash list and 19 YARA rules, and its startup-items check covers what's set to launch. A match is shown as worth a look and is never quarantined on its own; neither check can promise to catch every variant.
Adware that wraps legitimate software in custom installers carrying extra programs, then uses confusing install screens to get you to accept browser toolbars, search hijackers and ad-injecting software.
It's classed as adware or a potentially unwanted program rather than a virus: it doesn't copy itself. MITRE ATT&CK notes it has many features associated with more traditional backdoors, and Apple's XProtect has signatures and a Remediator module for it.
Choose Custom or Advanced options when installing and turn off bundled offers, and download software from the developer's own site rather than third-party portals.
Free, with no account: the scan checks your Downloads folder against a built-in malware-hash list and 19 YARA rules.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser