VSearch is macOS adware, usually installed by bundled installers, that turns words on web pages into ad links and shows pop-ups unrelated to the sites you have open. If that's happening, remove extensions and apps you didn't add and check your LaunchAgents and LaunchDaemons folders for unfamiliar items.
Last reviewed · 3 sources
Also known as: OSX.VSearch, MacVSearch, OperatorMac
OSX.VSearch is Malwarebytes' name for a family of macOS adware that is usually installed by bundlers; it can turn text on web pages into hyperlinks and show pop-ups unrelated to the sites you have open. Trend Micro documented a variant that, on OS X Yosemite (10.10), dropped a shell script exploiting the DYLD_PRINT_TO_FILE vulnerability to give the user passwordless sudo rights through /etc/sudoers. Security companies name it differently, and Objective-See notes that OSX.Pirrit is also called VSearch. XProtect 5368 (macOS 26.5, checked October 29, 2026) carries a signature named OSX.VSearch.A.
Bundled with free software downloads from third-party sites, such as fake media players and PDF readers
Install screens where VSearch is pre-selected as an 'optional' component
Download portals that wrap legitimate software in ad-injecting installers
Fake Flash Player update prompts on compromised or malicious websites
Words on web pages turned into links you didn't expect
Pop-ups unrelated to any site you have open
Extra ads on sites that normally don't show them
Searches redirected through unfamiliar domains before reaching your search engine
Look in /Library/LaunchDaemons, /Library/LaunchAgents and ~/Library/LaunchAgents for plists with 'vsearch' or other unfamiliar names, and delete them (system folders need an administrator password).
Check /Library/Application Support, ~/Library/Application Support and /Library/PrivilegedHelperTools for VSearch-related files and folders, and remove them.
Check /Applications for apps installed alongside the software you wanted, and delete the ones you don't recognize.
Remove ad-injecting extensions from Safari (Settings › Extensions), Chrome (chrome://extensions) and Firefox (about:addons), and reset each browser's homepage and search engine.
CoreLock's free scan includes a startup-items check, which lists launch items that manual removal may have missed.
Avoid download wrapper sites that bundle adware with legitimate apps
Choose Custom Install and turn off pre-selected optional software
Ignore Flash Player update prompts; Flash has been discontinued since the end of 2020
Keep macOS updated so XProtect's signatures stay current
What it can and can't do
VSearch keeps running through launch items, which the startup-items check in CoreLock's free scan covers. It can't promise to catch every variant.
Malwarebytes lists the symptoms: text on web pages turned into hyperlinks, and pop-ups that have nothing to do with the sites you have open. Extra ads on sites like Wikipedia or in search results are another hint.
Deleting the app it came with leaves its launch items and helper files behind, and those put it back. Remove the plists in your LaunchAgents and LaunchDaemons folders, the support files and its browser extensions.
Mostly annoying, but not always harmless: Trend Micro documented a Yosemite-era variant that exploited a macOS flaw to grant passwordless administrator rights. Apple's XProtect still carries a signature for it.
Free, with no account: the scan checks your Downloads folder against a built-in malware-hash list and 19 YARA rules.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser