Genieo is macOS adware, a browser hijacker usually installed by bundled installers, that replaces your search engine and homepage with its own search showing sponsored results. If your browser's search or homepage changed to Genieo, remove the Genieo app and its extensions, then reset your browser settings.
Last reviewed · 3 sources
Also known as: OSX.Genieo, InstallMac, Genieo Search
Genieo is a browser hijacker that behaves like adware: it acts as a search engine that shows sponsored results and is usually installed by bundled installers (Malwarebytes). Intego has reported Genieo installers that behave in sketchy ways. Apple treats it as malware: XProtect 5368 (macOS 26.5, checked October 29, 2026) carries signatures named OSX.Genieo.A to OSX.Genieo.G and an XProtect Remediator module named Genieo.
Bundled with free software installers from third-party download sites
Install screens where Genieo is offered as an 'optional' extra that's checked by default
Installers for other software that add search-changing extensions
Browser homepage and default search engine changed to Genieo search
Browser extensions named Genieo that you didn't add
More sponsored search results and ads than usual
Launch items with 'genieo' in the name in your LaunchAgents or LaunchDaemons folders
Quit Genieo, then delete any Genieo app from /Applications and Genieo folders from /Library/Frameworks and ~/Library/Application Support.
Look in ~/Library/LaunchAgents, /Library/LaunchAgents and /Library/LaunchDaemons for plist files with 'genieo' in the name, delete them, then restart.
In Safari, open Settings › Extensions; in Chrome, chrome://extensions; in Firefox, about:addons. Remove anything Genieo-related.
In each browser, set your homepage and default search engine back by hand.
CoreLock's free scan checks startup items, which can show launch items manual removal missed. Check browser settings and extensions yourself.
Choose Custom Install for free software and turn off bundled extras
Download software from the Mac App Store or the developer's own site
Ignore pop-ups offering to 'personalize' your homepage or search
Keep automatic security updates on so XProtect Remediator stays current
What it can and can't do
Genieo keeps itself running with launch items, which the startup-items check in CoreLock's free scan covers. CoreLock doesn't change browser settings, and it can't promise to catch every variant.
The usual sign is your browser's homepage or search engine switching to Genieo search without your say. Look for Genieo extensions in your browsers and for launch items with 'genieo' in the name in your LaunchAgents and LaunchDaemons folders.
It's adware, a browser hijacker, not a virus that copies itself. Apple still treats it as malware: XProtect 5368 (macOS 26.5, checked October 29, 2026) has signatures for seven Genieo variants and a Remediator module that removes it in the background.
Deleting the app leaves its launch items, which can reinstall it at the next login. Remove the plist files in your LaunchAgents and LaunchDaemons folders and its browser extensions too.
It isn't a password stealer like Atomic Stealer. It changes your search, so the searches you make go through it, which is a privacy problem in itself.
Free, with no account: the scan checks your Downloads folder against a built-in malware-hash list and 19 YARA rules.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser