ChromeLoader malware: what it is and how to remove it
ChromeLoader malware is designed to install malicious browser extensions onto browsers, and it targets machines running Windows and macOS. The threat has been spread on Twitter with the QR codes promoting pirated software like video games or movies, and TV shows.
Facts checked October 7, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
Programs like ChromeLoader malware usually arrive in groups; a free scan lists the companions that are easy to miss.
Do it yourself · free Remove ChromeLoader malware yourself 5 steps, about 15 minutes, no software needed.
Start the steps
ChromeLoader malware: summary
| Distribution | Deceptive posts on social media, advertising campaigns, pirating platforms, torrents |
|---|---|
| Damage | Affects the speed and performance, leads to privacy issues, exposes users to possible malware content |
| Name | ChromeLoader malware |
| Type | Browser hijacker, unwanted application, potentially unwanted program |
| Issues | The app causes advertisements out of nowhere, triggers issues with the performance and speed of the machine, manipulates browser settings and affects online traffic |
| Detection names | No Microsoft detection name is known |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 5 more facts
| Symptoms | An unknown program in Installed apps |
|---|---|
| Evidence | 4 write-ups by security sites; details still limited |
| Program | ChromeLoader malware |
| First seen | 27 May 2022 |
| Facts checked | 7 October 2026 |
Is ChromeLoader malware dangerous? What it collects
From our report of May 2022 · not reviewed since
Damage of the browser hijacker
ChromeLoader malware infection can start with malicious advertising material online and downloading the ISO file.
Experts reported that these campaigns mainly start with Twitter posts. Malware creators claim to offer pirated or cracked versions of games or software, so the ISO is installed without the users' knowledge.
The malware is launched when the ISO file is double-clicked, so the executable that pretends to be a game or keygen installs the malware. once it is executed, the PowerShell command is executed to fetch browser-based programs from remote resources. Then all the issues begin with the background processes.
Sadly people do not know that common social media campaigns, video sites, game crack portals, and torrent services can deliver these downloaders filled with ChromeLoader browser hijackers or different intruders. The PowerShell creates the task name ChromeTask that is triggering the launch every ten minutes.
This PowerShell script also adds the malicious Google Chrome extensions to the machine. Sometimes these processes cause the crash of the web browser, which indicates the infection. More tech-savvy people can run the anti-malware tools then and let these tools detect the ChromeLoader browser hijacker.
From our report of May 2022 · not reviewed since
More from our earlier report on ChromeLoader malware
- Threats can be removed with anti-malware tools
- Infections cause issues with the machine, so run to repair those issues with the machine
How ChromeLoader malware got into your browser
From our report of May 2022 · not reviewed since
ChromeLoader malware is designed to install malicious browser extensions onto browsers, and it targets machines running Windows and macOS.
The threat has been spread on Twitter with the QR codes promoting pirated software like video games or movies, and TV shows. The infection made headlines recently due to the fact that campaigns appeared to be extremely active these days, and many samples of different variants with particular distribution methods have been discovered.
This browser hijacker modifies the web browser settings to show search results filled with promotional material that push unwanted software, fake giveaways, and surveys and redirects people to adult games, online dating sites, and other commercial platforms. ChromeLoader malware creators get financial gains due to the marketing affiliation from these ad-supported pages and redirect traffic to these commercial sites.
There are many potentially unwanted programs like this browser hijacker. However, the infection caused a major buzz due to the persistent and different methods involved. There are huge volumes of malware spreading around, and the infection route involving aggressive use of PowerShell is not common for browser-based apps. This is a persistent threat to this ChromeLoader hijacker.
The infection also targets macOS devices and tries to manipulate Chrome and Safari web browsers. The infection is similar to the Windows versions, but it uses DMG files instead of ISO files used for Windows machines. The threat still can ensure persistence with user logs and continuous processes running on the machine.
Once the malicious executable with the malware is launched, you might see some error messages or other indications that inform you about issues with the machine. These are the method used by the malware to mask the background processes and avoid detection. Suspicious users might start to check machines when symptoms like this occur.
How to remove ChromeLoader malware
How to remove ChromeLoader malware and get your search engine back
Remove the extension first.
The search settings only stay fixed once nothing on the PC can change them again.
Step 1: Remove extensions you did not add
In Chrome open
chrome://extensions, in Edgeedge://extensions, and in Firefox the menu > Extensions and themes.Remove every extension you do not remember adding, especially search, new tab, coupon, PDF, weather or video downloader add-ons. Check every browser and every profile, because each keeps its own list.
If an extension has no Remove button or comes back, a browser policy holds it (see "Managed by your organization" in the procedure below). The pages are the same on Windows 11 and Windows 10.
Chrome on Windows 11: More > Extensions > Manage extensions. Full procedure with screenshots: Remove a browser extension
Step 2: Put the search engine back
In Chrome open Settings > Search engine > Manage search engines and site search, make an engine you trust the default, and delete entries you did not add.
In Edge type
search engineinto the search box at the top of Settings and open Manage search engines; in Firefox use Settings > Search. Then check the homepage and the new tab page in the same settings, because hijackers change all three.If the wrong engine is back after a restart, an extension, a program or a policy still sets it, so finish the other steps and check again. The settings are the same on Windows 11 and Windows 10.
Chrome on Windows 11: check Search engine and On startup. Full procedure with screenshots: Reset a browser and fix a hijacked search engine
Step 3: Uninstall ChromeLoader malware
ChromeLoader malware is removed like any other program, from the list of installed apps. In Windows 11 that is Settings > Apps > Installed apps, in Windows 10 Settings > Apps > Apps & features, and in both you can also use Control Panel > Programs and Features.
Select ChromeLoader malware, click Uninstall and follow the uninstaller to the end. Then look at the entries just above and below it when the list is sorted by date: bundled programs install at the same minute.
Full procedure with screenshots: Uninstall a program or app in Windows On uGetFix
Step 4: Reset the browser
A reset removes what the steps above could miss:
- changed start pages
- site permissions
- hidden settings
In Chrome open Settings > Reset settings > Restore settings to their original defaults; in Edge Settings > Reset settings; in Firefox Help > More troubleshooting information > Refresh Firefox.
Tip: Bookmarks and saved passwords stay, while extensions are turned off and the search engine and start page return to the defaults.
Reset every browser on the PC, including Edge, which Windows 11 and Windows 10 always have.
Chrome on Windows 11: Settings > Reset settings. Full procedure with screenshots: Reset a browser and fix a hijacked search engine
Step 5: Scan the PC, then run the offline scan
A scan finds the parts of ChromeLoader malware that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Instructions for each browser and system
The detailed steps for every browser and system this guide covers. Open the one you use.
Remove from Google Chrome
Delete malicious extensions from Google Chrome:
- Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
- In the newly opened window, you will see all the installed extensions. Uninstall all suspicious extensions related to the unwanted program by clicking Remove.
Clear cache and web data from Chrome:
- Click on Menu and pick Settings.
- Under Privacy and security, select Clear browsing data.
- Select Browsing history, Cookies and other site data, as well as Cached images and files.
- Click Clear data.
Change your homepage:
- Click menu and choose Settings.
- Look for a suspicious site in the On startup section.
- Click on Open a specific or set of pages and click on three dots to find the Remove option.
Reset Google Chrome:
If the previous methods did not help you, reset Google Chrome to eliminate all the unwanted components:
- Click on Menu and select Settings.
- In the Settings, scroll down and click Advanced.
- Scroll down and locate Reset and clean up section.
- Now click Restore settings to their original defaults.
- Confirm with Reset settings.
Delete from macOS
Remove the unwanted application:
- From the menu bar, select Go > Applications.
- In the Applications folder, look for any suspicious entries, then drag them to Trash (or right-click and pick Move to Trash).
Delete leftover files and folders:
- Select Go > Go to Folder.
- Enter /Library/Application Support and remove any suspicious folders related to the unwanted program.
- Repeat the same check in the /Library/LaunchAgents and /Library/LaunchDaemons folders, deleting any suspicious entries.
- Finally, empty the Trash to permanently remove the leftovers.
Stream videos without limitations, no matter where you are
There are multiple parties that could find out almost anything about you by checking your online activity.
While this is highly unlikely, advertisers and tech companies are constantly tracking you online. The first step to privacy should be a secure browser that focuses on tracker reduction to a minimum.
Even if you employ a secure browser, you will not be able to access websites that are restricted due to local government laws or other reasons. In other words, you may not be able to stream Disney+ or US-based Netflix in some countries. To bypass these restrictions, you can employ a powerful VPN, which provides dedicated servers for torrenting and streaming, not slowing you down in the process.
Data backups are important - recover your lost files
Ransomware is one of the biggest threats to personal data.
Once it is executed on a machine, it launches a sophisticated encryption algorithm that locks all your files, although it does not destroy them. The most common misconception is that anti-malware software can return files to their previous states. This is not true, however, and data remains locked after the malicious payload is deleted.
While regular data backups are the only secure method to recover your files after a ransomware attack, tools such as can also be effective and restore at least some of your lost data.
From our report of May 2022 · not reviewed since
Removing the infection
Even though this is a browser-based program and it manipulates browser settings to control the online traffic, you need t remove the infection properly.
ChromeLoader malware can be removed using anti-malware tools that are capable of detecting this infection. Tools like or can run the system scan and properly find these infections.
You can remove the virus and other related programs or cyber intruders this way, but some of the files and applications can still run on the machine and cause issues for the user. For that purpose, you should manually go through the particular settings and remove the PUP.
Instructions for Windows 10/8 machines:
If you are Windows 7/XP user, proceed with the following instructions:
Do not forget that this infection affects various machines including macOS, iOS, and Android or Windows devices. You might want to clear the virus quickly, but these PUPs can be hidden in various places on the machine, so you need to remove the ChromeLoader malware properly.
There are particular instructions for the browser resetting, so the issues and changes made by the browser hijacker can be solved, but these issues with the system and performance when redirecting annoy users can still occur due to the existence of the malware in the background. You should take care of that yourself. You can remove the ChromeLoader malware from macOS devices manually too.
- Enter Control Panel into Windows search box and hit Enter or click on the search result.
- Under Programs, select Uninstall a program.
- From the list, find the entry of the suspicious program.
- Right-click on the application and select Uninstall.
- If User Account Control shows up, click Yes.
- Wait till uninstallation process is complete and click OK.
- Click on Windows Start > Control Panel located on the right pane (if you are Windows XP user, click on Add/Remove Programs).
- In Control Panel, select Programs > Uninstall a program.
- Pick the unwanted application by clicking on it once.
- At the top, click Uninstall/Change.
- In the confirmation prompt, pick Yes.
- Click OK once the removal process is finished.
Questions about ChromeLoader malware
Can I safely uninstall ChromeLoader malware?
If you did not install ChromeLoader malware yourself and it is not part of your hardware or a program you rely on, yes. Uninstalling an unwanted program does not harm Windows. Before you do, search the exact name and publisher to be sure it is not a driver tool, a printer utility or a game launcher with an odd name.
Then remove it from Settings, Apps, Installed apps. Ignore any offers or warnings in its uninstaller about losing protection or performance. Afterwards check Startup apps and your browsers for leftovers, and restart once to confirm that it does not reinstall itself.
ChromeLoader malware came back after I uninstalled it. Why?
Something else is reinstalling it. Common causes are a second program from the same publisher, a scheduled task that downloads it again, or a browser extension that keeps prompting for it. Sort Installed apps by install date and uninstall each entry from the same day that you did not choose.
Then open Task Scheduler and look in the Task Scheduler Library for tasks with updater-style names that you do not recognise. Check Startup apps in Task Manager too. If ChromeLoader malware still returns, start Windows in Safe Mode, uninstall it there and run a Microsoft Defender offline scan, which looks for loaders that ordinary scans can miss.
Why can't I change my search engine back?
Because something keeps setting it. If an extension controls the search engine, Chrome and Edge show a note that an extension is controlling this setting, and your change is reverted. If a policy controls it, the field is greyed out and the browser shows Managed by your organization.
Remove the extension first, then the policies, and only then change the search engine; the change will stay. If it still reverts, look for a program in Installed apps or a scheduled task that reinstalls the extension.
Is only one browser affected?
Often not. Programs that install hijackers tend to change every browser they find, and sync can carry the extension to other computers signed in to the same browser account. Check Chrome, Edge and Firefox, even the ones you rarely use, and look at the shortcut targets on the desktop and taskbar for each.
If you use sync, remove the extension while signed in so the removal syncs too. Also check the On startup setting and the new tab page, because hijackers change those as well as the search engine.
What do I lose if I reset Chrome or Edge?
Less than you might think. A reset turns off all extensions, which you can turn back on one by one, restores the default search engine, home page, new tab and pinned tabs, and clears cookies, so you are signed out of most sites.
Bookmarks, history, saved passwords and autofill data stay. Firefox's equivalent, Refresh Firefox, keeps the same essentials but removes add-ons completely. Before you reset, make sure you know your main passwords or have them saved, since you will need to sign in again.
What is ChromeLoader?
ChromeLoader malware is designed to install malicious browser extensions onto browsers, and it targets machines running Windows and macOS. The threat has been spread on Twitter with the QR codes promoting pirated software like video games or movies, and TV shows.
Damage: Affects the speed and performance, leads to privacy issues, exposes users to possible malware content. The summary table at the top of this guide lists the type, the detection names, the symptoms and the damage of ChromeLoader. Reading it first helps you decide whether your computer shows the same signs.
How did ChromeLoader get on my computer?
Our report lists the distribution as deceptive posts on social media, advertising campaigns, pirating platforms, torrents. Software of this kind often comes bundled with free programs, fake updates or downloads from unofficial sites.
It can also arrive through a browser extension or a notification you allowed on a spam page. Think back to what you installed or allowed just before the first ad or redirect appeared.
Will my antivirus detect ChromeLoader?
Not always, because our check found no Microsoft Defender detection name for it. Our check found no Microsoft Defender detection name for it, so a scan may not name it. Update the security program first, then run a full scan instead of a quick one.
Also scan with a second on-demand scanner, because one program can miss what another finds. A clean scan does not prove the signs are gone, so check the browser extensions and installed programs by hand too.
Will Fortect remove ChromeLoader malware?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For ChromeLoader malware, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Malwarebytes: ChromeLoader targets Chrome Browser users with malicious ISO files ChromeLoader targets Chrome Browser users with malicious ISO files (read October 7, 2026)
- Wikipedia: PUP (read October 7, 2026)
- Dieviren: Dieviren (read October 7, 2026)
- FTC: How to recognize, remove and avoid malware (read October 7, 2026)
- Microsoft Learn: Microsoft Defender Offline (read October 7, 2026)