PDF Spark: what it is, why vendors flag it, and how to remove it from a Mac or Windows PC
PDF Spark (also written PDFSpark) is a free PDF viewer that security vendors classify as a potentially unwanted program; our 2019 guide covered a Mac version, and since 2025 Windows installers signed by Mainstay Crypto LLC have been blocked by Malwarebytes and Sophos. It is not safe to keep:
- uninstall it
- remove what came with it and check your browsers
- using the steps for your system
Facts checked October 7, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
If pdfspark.com returns after you change the search engine back, a free scan can find the program that keeps setting it.
Do it yourself · free Remove PDFSpark yourself 2 steps, about 6 minutes, no software needed.
PDFSpark: summary
| Type | Potentially unwanted PDF viewer; a Mac installer in our 2019 report, a Windows installer in 2025-26 vendor reports |
|---|---|
| Risk | High for the Windows installer (vendor verdicts); medium for the 2019 Mac version, which we could not test |
| Symptoms | A PDFSpark app you did not choose; extra programs installed with it; ads or pop-ups; new extensions, search engine or start page; on Windows, an OBUpdate task or OneBrowser (one analyst's report) |
| How to get rid of it | Mac: uninstall the app, remove login items, extensions and helper files, reset browser settings. Windows: uninstall, Defender full and offline scan, check Task Scheduler |
| Our check (5 October 2026) | pdfspark.com returned 502 Bad Gateway; registry records read; no installer run, no browser test, so nothing about its behaviour is cleared |
| Running since | pdfspark.com registered 15 November 2018; sparkonsoft.com registered 2 August 2026 |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 11 more facts
| First reported by us | 2 April 2019 |
|---|---|
| Detection | Malwarebytes: PUP.Optional.SparkOnSoft; Sophos: PUA Signer [Mainstay Crypto LLC]; Microsoft Defender: no Microsoft detection name is known to us, and we scanned no sample |
| Publisher | Mainstay Crypto LLC on the Windows installers (Malwarebytes, Sophos, Deceptive Bytes) |
| Distribution | Download pages, wrong download buttons and bundles; ads or chat answers suspected for 2025 |
| Evidence | Malwarebytes, Sophos, Deceptive Bytes, one analyst write-up, registry records, our 2019 report |
| Name | PDFSpark |
| Search page | pdfspark.com |
| Browsers | Chrome, Edge and Firefox |
| First seen | 2 April 2019 |
| Damage | Searches logged and filled with ads, browser settings locked |
| Facts checked | 5 October 2026 |
Facts checked on 5 October 2026 against the Malwarebytes and Sophos pages, the Deceptive Bytes report, one analyst write-up and the registry records of pdfspark.com and sparkonsoft.com. pdfspark.com returned 502 Bad Gateway, so we saw no page; no installer was run on any system, so the behaviour described is reported, not tested by us.
What PDFSpark is, on a Mac and on Windows
PDFSpark is a free PDF viewer that Malwarebytes calls PUP.Optional.SparkOnSoft and Sophos detects by its signer, Mainstay Crypto LLC. Our 2019 guide covered a Mac version; the 2025-26 vendor reports cover Windows installers. The steps differ, so check your own system first.
- What it claims to be
- A "Free PDF Viewer, Annotator and Converter For MAC", according to the download page in our 2019 picture; the Windows build is described by Sophos as a PDF viewer and manager with a reader, bookmarking and text extraction
- How it usually arrives
- Installed by users who clicked another download button than they meant to, or as bundleware, according to Malwarebytes
- Website
- pdfspark.com, registered 15 November 2018 (registry record); a second domain, sparkonsoft.com, is named in a 2025 security report
- Mac or Windows
- Our 2019 guide and pictures: Mac. Vendor reports from 2025 and 2026: Windows. We found no vendor page about a current Mac build
PDFSparkware, pdfspark.exe and the Microsoft Defender name PUA:Win32/PDFSpark
PDFSparkware and PDF Sparkware are, in our reading, the same PDF Spark viewer this guide covers.
We found no reliable source that uses Sparkware as a product name. Most likely people join PDF Spark and software, or mix it with SparkOnSoft, the name Malwarebytes uses in PUP.Optional.SparkOnSoft. If an app called PDFSparkware or PDF Sparkware sits in your installed programs or Applications folder, treat it as PDF Spark and remove it with the steps above.
Pdfspark.exe is the program file of the Windows version of PDF Spark. A file with that name in Task Manager, in Startup apps or in your Downloads folder means the viewer was installed or its installer was downloaded.
Right click the process in Task Manager and choose Open file location to see where it lives. Then uninstall PDF Spark in Settings, delete the leftover installer and run the Microsoft Defender scans described above.
PUA:Win32/PDFSpark is a real Microsoft Defender Antivirus detection name for this viewer. Microsoft published its entry on 28 November 2025 and lists it as a potentially unwanted application, not a virus.
Microsoft says the threat can perform actions of a malicious actor's choice and lists symptoms such as slow performance, changed files and desktop settings. If Defender shows this name in Protection history, choose Remove, then check your browsers for a new search engine or start page.
Is PDFSpark dangerous? What it collects
What we checked on 5 October 2026
We asked for the site's pages and read the registry records of both domains. We did not open either site in a browser, and we did not download or run any installer, Mac or Windows. This is a reading of what answers and what vendors say, not a behaviour test, and nothing here clears the program.
pdfspark.com and sparkonsoft.com · requests and registry records · 5 October 2026
- pdfspark.com answersOur request and a second fetch service both got "502 Bad Gateway" on 5 October 2026. We saw no page at all. We do not know when it stopped, or whether it is down for everyone or only for requests like ours.
- pdfspark.com registrationRegistered on 15 November 2018, expires on 15 November 2026; the registry lists transfer, update and delete locks, a common registrar setting.
- sparkonsoft.com todayThe registry shows a registration date of 2 August 2026, and the domain now serves a parked for-sale page. A 2025 report named it as the site that spread the installer; what it served then we could not see.
- Vendor verdicts (Windows)Malwarebytes lists PUP.Optional.SparkOnSoft, and Sophos (article of 24 September 2026) detects every installer signed by Mainstay Crypto LLC and says the certificates were revoked.
- Mac buildNot obtained. We could not confirm that a current Mac installer exists, what it offers or whether the 2019 behaviour still applies.
- Notification request, pop-ups, redirects, ad networksNot tested. The site returned no page, and a quiet visit would not clear it anyway: adware sites often differ by country, device or second visit.
High risk (Windows installer) Our own test saw only an error page, so it says little. The verdict comes from the vendors: a Windows installer with this signature should be treated as unwanted. For the 2019 Mac version we have only our old report, so treat it as medium until you can see what is on your Mac.
From a 2019 Mac installer to a 2025 Windows campaign
November 2018
pdfspark.com is registered
The registry record shows the registration on 15 November 2018 and a renewal date of 15 November 2026.
April 2019
Our report on the Mac installer
We described PDFSpark as a Mac PDF viewer and converter promoted by a download page and spread through software bundles. The picture shows the download page and the installer window.
The picture from our 2019 report: the PDFSpark download page ("Free PDF Viewer, Annotator and Converter For MAC") and its installer window with a Continue button. The red FAKE stamp is part of that 2019 picture, not something the program shows. The page says "Additional software may be offered during the installation process". October 2025
A surge of Windows installers
On 26 October 2025 an endpoint-security firm reported a week of new variants, all installs of a "PDF SparkOnSoft" application, blocked for customers worldwide. Malwarebytes had published its detection page two days earlier.
September 2026
Sophos publishes its detection note
Sophos dates its note 24 September 2026 and says it detects the signer "Mainstay Crypto LLC" because the certificates were revoked for malicious use.
The Windows campaign: what is reported and how far to trust it
Three sources describe the Windows installers: a security-vendor note (Sophos), a detection page (Malwarebytes) and an incident write-up (Deceptive Bytes). A fourth, a Medium article by one analyst, goes much further. We did not run any of these samples, so each claim is marked with who made it.
| Claim | Who says it | How we treat it |
|---|---|---|
| The installer is signed with certificates from "Mainstay Crypto LLC", and the certificates were revoked for malicious use | Sophos; Deceptive Bytes names one issuer (Sectigo) as revoked and a second (Microsoft-issued) as still valid at the time | Two vendors agree on the signer. The revocation status of each certificate may change; we did not check |
| The installer is built with Inno Setup, shows version 1.0.0.0, and checks whether it runs under WINE before it continues | Deceptive Bytes | From one security firm's analysis. The WINE check would stop a Mac running Windows software through WINE from being infected; it does not mean a Mac user is affected |
| Software installed by the user after clicking another download button, or bundled with other software | Malwarebytes | Stated as how it "usually" arrives; it matches our 2019 report |
| A scheduled task called OBUpdate and a OneBrowser program installed next to the PDF viewer | One analyst (Medium) | Single source, not reproduced by us. Check Task Scheduler for it; its presence would be a strong sign, its absence proves nothing |
| An Uninstall entry named PDF_Spark_is1 with the modify and repair options switched off, and extra certificates in the Windows root store | One analyst (Medium) | Single source, not confirmed by any vendor page we read. We do not tell you to edit the registry for it |
What can actually go wrong
The risks depend on which version you have. They are listed from most to least serious.
- High
A Windows installer that vendors treat as hostile
Sophos says the signing certificates were revoked for malicious use and that every installation signed with them is a significant risk. Deceptive Bytes saw the installers blocked at many customers. If you ran one, assume a program you did not choose is installed and may contact outside servers.
- Medium
More software than you asked for
Our 2019 guide said PDFSpark pushed its user into downloading similar programs. Sophos adds that the Windows application is often bundled with other software. Each extra is its own program with its own behaviour.
- Medium
Advertising and changed browser settings
The 2019 guide listed pop-ups, banners and redirects, and said a program like this can add extensions, search engines and similar components to Safari, Chrome or Firefox. We did not see this on a Mac; it is what the old guide recorded.
- Medium
Information about your computer
The old guide said such programs can read details about the software and equipment on the Mac, and that advertisers use it. We found no source describing what PDFSpark collects, so treat this as a possibility.
How PDFSpark got into your browser
A PDF tool is a program people look for on purpose, which is why this one spreads. Most cases follow one of these routes.
| Route | What you would see | How to check |
|---|---|---|
| You downloaded it on purpose from its own page or a link in an ad | A page offering a free PDF viewer; an installer that opens its own window with a Continue button | Look in the Mac Downloads folder or Windows Downloads for a file with PDFSpark or SparkOnSoft in the name |
| You clicked another download button than you meant to | A PDF-looking file you did not ask for; Malwarebytes names this route first | Check the browser's download history for the page you were on |
| It came inside another free program's installer | A new program the same day as something else you installed | Mac Applications, sorted by date added; Windows Installed apps, sorted by install date |
| A search result, ad or chatbot answer pointed to it | Security researchers suspect malicious ads or chat-based AI answers for the 2025 installers, but did not prove it | Think back to where the link came from |
Our 2019 guide said the program also appears "out of nowhere" because software bundling is the main way potentially unwanted programs spread. The word to keep from that is bundling: the setup screen of a free tool is where extras are offered, and the quick path accepts them for you. The 2019 download page itself warned that "Additional software may be offered during the installation process", so even a willing install can bring extras.
Check your browser and PC
Neither the old guide nor the vendor pages we read list the Mac file names, so this is a search by place and by date, not a list of names. The Windows names come from the single analyst write-up and are marked.
| System | Where | What to look for |
|---|---|---|
| Mac | Finder > Applications | An app called PDFSpark, or anything unfamiliar added on the day you installed a PDF tool |
| Mac | System Settings > General > Login Items & Extensions | Items you do not recognise under Open at Login and App Background Activity; extensions under Added extensions |
| Mac | ~/Library/LaunchAgents, /Library/LaunchAgents, /Library/LaunchDaemons, /Library/Application Support | Folders and files with the same unknown name as the app. Open them with Go > Go to Folder in Finder |
| Windows | Settings > Apps > Installed apps | PDFSpark, PDF Spark or PDFSparkOnSoft, publisher Mainstay Crypto LLC; also OneBrowser (one analyst's report) |
| Windows | Task Scheduler > Task Scheduler Library | A task called OBUpdate (one analyst's report) or any task that runs from a Temp or AppData folder |
How to remove PDFSpark
How to remove PDFSpark and get your search engine back
Remove the extension first.
The search settings only stay fixed once nothing on the PC can change them again.
Which browser shows the ads?
Set another search engine
Open Settings > Search engine, click Change next to the search engine used in the address bar and pick the one you want. Then open Manage search engines and site search and delete any entry you did not add.
Remove extensions you do not recognise
Paste
chrome://extensionsinto the address bar and click Remove on anything you did not install yourself.Full procedure with screenshots: Remove a browser extension
Clear the site data
Press Ctrl + Shift + Delete, choose All time, tick Cookies and other site data and Cached images and files, and click Delete data.
Reset Chrome
Open Settings > Reset settings > Restore settings to their original defaults and confirm with Reset settings. This resets the start page, search engine and pinned tabs and turns off extensions; bookmarks and saved passwords stay.
Full procedure with screenshots: Reset a browser and fix a hijacked search engine
Set another search engine
Open Settings > Search and pick another engine under Default Search Engine. Under Search Shortcuts, remove any entry you did not add.
Remove add-ons you do not recognise
Paste
about:addonsinto the address bar, open Extensions, and choose Remove from the three-dot menu of anything you did not install yourself.Full procedure with screenshots: Remove a browser extension
Clear cookies and site data
Open Settings > Privacy & Security > Cookies and Site Data > Clear Data, tick both boxes and click Clear.
Refresh Firefox
Open the menu > Help > More troubleshooting information and click Refresh Firefox. Add-ons and custom settings are removed and the home page goes back to default; bookmarks, history and passwords stay.
Full procedure with screenshots: Reset a browser and fix a hijacked search engine
Remove PDFSpark if it is still there
Quit the app, then use its Uninstall item if it has one, or drag PDFSpark from Finder > Applications to the Bin and empty it.
Set another search engine
Open Safari > Settings > Search and choose a different Search engine if the current one is not yours.
Remove extensions you do not recognise
In Safari > Settings > Extensions, select anything you did not install yourself and click Uninstall.
Clear the site data
In Safari > Settings > Privacy > Manage Website Data, remove the site's data, or use History > Clear History > all history. To empty the cache as well, turn on Show features for web developers in Settings > Advanced and choose Develop > Empty Caches.
Check the Mac for items that came with it
In System Settings > General > Login Items & Extensions, remove unknown items. Then use Go > Go to Folder to check
/Library/LaunchAgents,~/Library/LaunchAgents,/Library/LaunchDaemonsand/Library/Application Supportfor folders and files with the same unknown names, and empty the Bin.
Then, whichever browser you use
Step 1: Uninstall programs you did not mean to install
PDFSpark rarely comes alone: it is usually installed by, or together with, a free program. In Windows 11 open Settings > Apps > Installed apps, in Windows 10 Settings > Apps > Apps & features, and sort by install date.
Uninstall every entry from the day the trouble began that you did not install on purpose, for example a download manager, a converter or a browser you never chose.
Keep drivers and entries from Microsoft, Intel, AMD, NVIDIA or your PC's maker unless you are sure.
Full procedure with screenshots: Uninstall a program or app in Windows On uGetFix
Step 2: Scan the PC, then run the offline scan
A scan finds the parts of PDFSpark that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
After removal: keep your search engine and start page
If you installed it: Mac steps, then Windows steps
Do only the part for your computer. A Mac cannot run the Windows installer, and a Windows PC has no Mac steps.
- 1
Mac: quit the app and use its uninstaller if it has one
Quit PDFSpark. In Finder > Applications, look for an Uninstall or Uninstaller app next to it: Apple says that is the best way to remove an app together with its login items and extensions. The 2019 download page had an Uninstall link in its menu, so the maker offered one then.
- 2
Mac: otherwise drag it to the Bin
Select the app and choose File > Move to Trash, enter your administrator password if asked, then choose Finder > Empty Trash. This does not remove login items or helper files.
- 3
Mac: remove login items and extensions
Open Apple menu > System Settings > General > Login Items & Extensions. Under Open at Login select any item you do not recognise and click the minus button; look under Added extensions too.
- 4
Mac: check the helper folders
In Finder choose Go > Go to Folder and look in
~/Library/LaunchAgents,/Library/LaunchAgents,/Library/LaunchDaemonsand/Library/Application Supportfor items with the same unknown name as the app. Drag them to the Bin and empty it. The old guide had this step as its macOS block; we could not confirm specific file names for PDFSpark. - 5
Mac: clean up each browser
Use the Safari, Chrome and Firefox tabs above: remove extensions you did not add and set your own search engine and start page.
- 6
Windows: uninstall it
Open Settings > Apps > Installed apps in Windows 11 (Apps & features in Windows 10), sort by install date and uninstall PDFSpark and anything installed the same day that you do not recognise (Uninstall a program or app in Windows On uGetFix). One analyst reports that the entry may have its modify and repair options disabled; if the entry has no Uninstall, go straight to the scan.
- 7
Windows: scan, then scan offline
Run a Microsoft Defender Full scan, then Microsoft Defender Antivirus (offline scan) in Windows Security > Virus & threat protection > Scan options. Microsoft says the offline scan runs after a restart without loading Windows, so persistent malware has a harder time hiding. Save open files first.
- 8
Windows: check Task Scheduler
Press Start, type Task Scheduler, open Task Scheduler Library and look for OBUpdate or a task that runs a file from an unfamiliar folder. Right-click it and choose Delete only when it clearly belongs to this install. We did not run the installer, so the task name is not confirmed by us.
- 9
Both: restart and check again
Restart, then open the browser settings and the login items or installed apps again. If a setting or an item returns, something is still putting it back.
How to keep it from happening again
Do
- Open PDFs with the viewer that came with your system or your browser, and look for others only by the maker's own name, not through ads.
- Read every screen of an installer. Choose a Custom or Advanced option when one is offered, and untick extra programs, toolbars and search settings.
- After installing any free program, open each browser's search engine and start page once and check them.
- Check the publisher name in the installer's properties or the Windows warning before you run it.
- Keep Microsoft Defender SmartScreen, or Chrome's Enhanced protection, turned on: both warn about known bad downloads.
- Keep a current backup of your files (Time Machine on a Mac, File History or OneDrive on Windows), so a bad install never costs you documents.
- On public networks, a VPN hides your IP address from the sites and ad networks you visit; it does not block ads or malware.
Don't
- Click the first "Free download" button on a page: pages that offer PDF tools often carry several.
- Take a PDF tool from a link in an ad or a chatbot answer without checking the maker's site.
- Click through Default or Quick setup without reading it.
- Keep an app that Malwarebytes or Sophos flags just because a scan was quiet.
What to use instead of PDFSpark
You do not need a third-party PDF program for the jobs PDFSpark advertised: viewing, annotating and converting.
| Job | Option | What to know |
|---|---|---|
| View and annotate PDFs on a Mac | Preview, built into macOS | Apple Support describes adding text and signatures to PDFs in Preview and links a page on annotating a PDF |
| View PDFs on Windows | The PDF viewer in Microsoft Edge or Chrome | Both open a PDF in the browser; we did not test their editing features, so check them on a file you do not mind |
| Convert a PDF to another format | An office suite's export or print-to-PDF feature | We did not test any converter; avoid ones that ask for an installer |
| Keep PDFSpark | Not recommended | Two security vendors flag the Windows installers; for the Mac build we could not confirm a current version |
Questions about PDFSpark
What is PDF Spark?
PDF Spark is a free PDF viewer that security vendors classify as a potentially unwanted program. Our 2019 guide described a Mac version advertised as a PDF viewer, annotator and converter, which came with an installer offering extra software.
In 2025 vendors began flagging a Windows version signed by Mainstay Crypto LLC: Malwarebytes detects it as PUP.Optional.SparkOnSoft and Sophos detects the signer.
Malwarebytes says people usually install it themselves after clicking the wrong download button, or get it bundled with other software. We did not run any installer, so what it does on your system is what vendors and the old guide report.
Is PDF Spark safe?
No: two security vendors flag it, so do not keep it. Sophos says the certificates used to sign the Windows installers were revoked for malicious use and that every installation with that signature is a significant risk. Malwarebytes blocks the installer so the user can make an informed choice.
For the Mac version in our 2019 report we have no vendor verdict and could not test it, but its own page said additional software may be offered during installation. If you installed it, remove it with the steps above and check what else arrived the same day.
Is PDF Spark a virus?
Vendors call it a potentially unwanted program, not a virus in the classic sense, but that label hides how serious the Windows installers are. A potentially unwanted program is software you did not mean to keep, and it can still be harmful.
Sophos describes persistence on the machine and contact with suspicious servers, while one analyst's write-up goes further, naming a scheduled task and certificate changes. We could not confirm those details ourselves.
For the 2019 Mac version, our report described ads, extra downloads and added browser items. Treat it as unwanted on either system and remove it.
What is SparkOnSoft, and is it malware?
SparkOnSoft is the name in the file names and detections of the same installer family. Malwarebytes uses PUP.Optional.SparkOnSoft for the program it names PDF Spark, published by Mainstay Crypto LLC.
Deceptive Bytes reported a surge of installs of a "PDF SparkOnSoft" application in October 2025 and named sparkonsoft.com; the registry now shows that domain registered on 2 August 2026, with a for-sale parked page.
Several firms report and block it, but the finer details (a OneBrowser program, an OBUpdate task, added certificates) come from one analyst whom we could not check.
How do I remove PDFSpark from my Mac?
Quit the app, then open Finder > Applications and use its Uninstall item if it has one; otherwise choose File > Move to Trash and empty the Trash. Apple says the uninstaller is the best way because it also removes login items and extensions.
Then open System Settings > General > Login Items & Extensions and remove unknown items, and check ~/Library/LaunchAgents, /Library/LaunchAgents, /Library/LaunchDaemons and /Library/Application Support for items with the same unknown name. Finish by removing unknown extensions in Safari, Chrome and Firefox and setting your own search engine.
How do I remove PDF Spark from Windows?
Open Settings > Apps > Installed apps in Windows 11 (Apps & features in Windows 10), sort by install date and uninstall PDFSpark and anything else installed the same day. Then run a Microsoft Defender Full scan and, in Windows Security > Virus & threat protection > Scan options, the Microsoft Defender Antivirus (offline scan), which runs after a restart without loading Windows.
Check Task Scheduler for a task named OBUpdate, which one analyst reports. If the uninstall entry offers no Uninstall button, go straight to the offline scan. Restart and check again.
What is the latest PDF Spark version, and is there a safe one?
We could not find a safe version, and the sources we read give no current version number. The Deceptive Bytes report says the Windows installers it saw all showed version 1.0.0.0 and that the attackers likely did not change the installer between samples.
Sophos says every installation with the Mainstay Crypto LLC signature is a risk. When we asked for pdfspark.com on 5 October 2026 it answered 502 Bad Gateway, so we saw no download page. Use Preview on a Mac or the PDF viewer in your browser on Windows instead of looking for a clean build.
Will Fortect remove PDFSpark?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For PDFSpark, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Malwarebytes: PUP.Optional.SparkOnSoft threat alert (read October 5, 2026)
- Sophos Support: PUA detection release for PDFSpark Application (KBA-000043676) (read October 5, 2026)
- Deceptive Bytes: Case study, extinguishing SparkOnSoft malware (26 October 2025) (read October 5, 2026)
- Medium, Rabbit Knight: The Spark or the Smoke, PDF SparkOnSoft and OneBrowser (14 November 2025; single analyst, not reproduced) (read October 5, 2026)
- Verisign RDAP: pdfspark.com registration record (read October 5, 2026)
- Verisign RDAP: sparkonsoft.com registration record (read October 5, 2026)
- Our 2019 guide to PDFSpark (pictures and text) (read October 5, 2026)
- Apple Support: Delete or uninstall apps on Mac (read October 5, 2026)
- Apple Support: Change Login Items & Extensions settings on Mac (read October 5, 2026)
- Apple Support: Fill out and sign PDF forms in Preview on Mac (read October 5, 2026)
- Microsoft Support: Virus and Threat Protection in the Windows Security app (read October 5, 2026)
- Microsoft Support: Uninstall or remove apps and programs in Windows (read October 5, 2026)
- Google Chrome Help: Change your default search engine (no longer online) (read October 5, 2026)
- Microsoft Support: Change your default search engine in Microsoft Edge (read October 5, 2026)
- Mozilla Support: Change your default search settings in Firefox (read October 5, 2026)
- Apple Support: Change your search settings in Safari on Mac (read October 5, 2026)
- Microsoft Security Intelligence: PUA:Win32/PDFSpark (read October 7, 2026)