ReceiverHelper on Mac: is it a virus, or just old Citrix?

What ReceiverHelper is

In most reports ReceiverHelper is a helper program of Citrix, the remote-desktop software. The name and the Mac warning look like malware, but the sources we read point to old Citrix files that macOS now refuses to run.

1. 1

   Citrix was installed once

   Older Citrix Receiver builds for Mac put helpers in /usr/local/libexec: ReceiverHelper.app, ServiceRecords.app and AuthManager_Mac.app, each with a startup file in /Library/LaunchAgents, such as com.citrix.ReceiverHelper.plist.

2. 2

   A startup file runs it at login

   macOS reads those files at every login, whether or not you open Citrix. After the app is removed, the files can stay: one user's EtreCheck report shows Executable not found for ServiceRecords beside a ReceiverHelper entry.

3. 3

   Apple stopped trusting the signature

   On 23 August 2021 Apple updated XProtect and its other Mac security systems to reject code signed with a Symantec-issued certificate. Citrix had used one, and Malwarebytes' Thomas Reed reported that the files themselves were unchanged.

4. 4

   Gatekeeper shows the alert

   Gatekeeper, the check macOS runs before software starts, shows "ReceiverHelper will damage your computer". Apple says this appears when macOS detects malicious content or the software's authorisation was revoked, so the wording alone cannot tell the two apart.

Genuine file

/usr/local/libexec/ReceiverHelper.app, a Citrix program

Startup entry

/Library/LaunchAgents/com.citrix.ReceiverHelper.plist

Travels with

ServiceRecords and AuthManager_Mac: same alert, same cause

First alerts we found

28 April 2020 on a Citrix forum; widespread from 23 August 2021

Also a name for adware

One Mac-security site uses Receiver Helper for a browser hijacker. We found no vendor source, so it is unconfirmed

What we could and could not check

We looked at one Mac with no Citrix on it. That cannot show what your file is, but it shows what a clean Mac looks like.

Xearch helper on a Mac: what the name most likely is

We found no reliable source for a Mac program called Xearch helper or xearch-helper.

No vendor, Apple page or researcher we read names it. Our reading is that it is either a misspelling of a search helper you saw in a list, or the name of an adware item. Adload installs apps and startup files with changing, made up names that often end in Helper or Search, so a new name alone tells you little.

To check it yourself, search your Mac for the exact name in Finder, then look in /Library/LaunchAgents, ~/Library/LaunchAgents and /Library/LaunchDaemons for a .plist file that carries it. Open System Settings > General > Login Items & Extensions and System Settings > Privacy & Security > Profiles.

If the item sits next to a changed search engine, ads or an unknown profile, treat it as adware and follow the removal steps above. If nothing carries the name, your Mac is not running it.

Virus or Citrix: what our 2025 page claimed

Our January 2025 article called ReceiverHelper an Adload-family hijacker. The evidence we found points elsewhere, so this page sets out three readings and how to tell them apart.

• Low

  Old Citrix files

  Not malware, said Malwarebytes: "this isn't malicious at all". The cost is a repeating alert.

• Medium

  A hijacker with the same name

  A changed search engine, ads on pages that had none or a profile you did not install mean something else is installed. Remove it whatever it is called.

• High

  Clicking through the warning

  Apple's page says to look for an updated version or another app. Open Anyway on a file you cannot place means running unknown code.

Adload: the real family behind the old claim

Adload is real and active, but we found no source that puts a file called ReceiverHelper in it. It matters because it hides well.

1. 25 August 2017

   Apple's first Adload rules

   Howard Oakley of The Eclectic Light Company dates them to XProtect 2094, covering two variants. Adload probably appeared in 2016.

2. 2021

   Missed for months

   Intego reported that XProtect missed much of the malware until months after infections began. SentinelOne found it installing under names such as Kreberisec, Apollo and Aphrodite.

3. 23 April 2024

   74 new rules in one update

   XProtect 2192 added 74 Adload rules, including variants written in Python, Swift, Go and Kotlin.

4. 2026

   What Microsoft says

   Adware:MacOS/Adload.A impersonates video players or support agents, comes most likely from malicious links on third-party sites, and can be dropped by UpdateAgent trojans. Symptoms are unexpected login items, LaunchAgents and LaunchDaemons.

• Medium

  Spam and proxy use

  The University of Illinois says the Adload it found uses some processor and network capacity to send spam, which gets devices banned from its network.

• Medium

  Detection gaps

  SentinelOne showed an Apple rule that needed one specific string, which new builds left out. The University of Illinois says Mac antivirus did not reliably detect its variant. A clean scan is one piece of evidence, not an all-clear.

Do this before deleting anything. On a work Mac, stop at step 2 and ask IT.

1. 1

   Read the path in the alert

   If the dialog offers Show in Finder, click it. ReceiverHelper.app, ServiceRecords.app or AuthManager_Mac.app in /usr/local/libexec is the Citrix case. A file in Downloads, in a folder of random letters, or inside an app you never opened is not.

2. 2

   Ask whether Citrix is yours

   Do you or your employer use Citrix for remote desktops? If yes, update it from your company portal or Citrix's own download page, never from a pop-up.

3. 3

   See what macOS thinks of the file

   In Terminal run codesign --verify --verbose /usr/local/libexec/ReceiverHelper.app and spctl -a /usr/local/libexec/ReceiverHelper.app. Malwarebytes showed the Citrix copy printing valid on disk and satisfies its Designated Requirement, then rejected: unmodified but refused. We could not reproduce this without the file.

4. 4

   List the Citrix startup files

   Run ls /Library/LaunchAgents | grep -i citrix. Names starting com.citrix. confirm the old install. A random-named file in ~/Library/LaunchAgents is the adware pattern.

5. 5

   Look at the browser and profiles

   If your search engine or start page is not the one you picked, or System Settings > General > Device Management lists a profile you did not install, go to the adware chapter.

Two routes matter: an old install never cleaned up, and the installers adware uses.

If it is the old Citrix files

Steps 1 to 3 follow Citrix's own uninstall page; step 4 is Malwarebytes' last resort. We did not run them on an affected Mac.

1. 1

   Decide: keep Citrix or not

   On a work Mac, keep it and ask IT for the current Citrix Workspace app. On a home Mac that no longer connects through Citrix, remove it.

2. 2

   Quit and uninstall properly

   Quit the app (Command-Q), drag Citrix Workspace from Applications to the Bin and enter your password; Citrix says this deletes the app and its system files. The .dmg also has Uninstall Citrix Workspace App, and Citrix documents a Terminal command: sudo /Library/Application\ Support/Citrix\ Receiver/Uninstall\ Citrix\ Workspace.app/Contents/MacOS/Uninstall\ Citrix\ Workspace --nogui.

3. 3

   Restart, then look again

   If the alert is gone, you are done; install the current Citrix if you still need it. If it returns, check /Library/LaunchAgents for com.citrix.*.plist: Citrix's page does not say it clears files left by the old Receiver.

4. 4

   Last resort: remove the leftovers

   Malwarebytes says deleting the three helpers from /usr/local/libexec may solve it, may cause other problems, and is at your own risk. A Citrix administrator's post suggests launchctl remove com.citrix.ReceiverHelper first; we have not tested it. Never delete anything beginning com.apple..

If it is adware: removal on a Mac

These steps are for a hijacker or Adload-type adware, not Citrix. They come from our 2025 guide, corrected for current menu names and for file locations a university IT page and SentinelOne document.

1. 1

   Quit the process

   Open Finder > Applications > Utilities > Activity Monitor, select the suspicious process and click X, then Force Quit.

2. 2

   Move the app to the Bin

   In Applications sort by Date Added and drag anything you did not install, or installed just before the trouble, to the Bin. Empty it.

3. 3

   Remove login items and profiles

   System Settings > General > Login Items & Extensions: remove unknown items and switch off unknown ones under Allow in the Background (macOS 12 and older: System Preferences > Users & Groups > Login Items). Then General > Device Management: select a profile you did not install and click Remove.

4. 4

   Look for the known file pattern

   Go > Go to Folder, enter ~/Library/Application Support, and look for a folder of random digits and letters holding helper and pcyx.ver, and one starting org. plus random characters holding app_assistant. The University of Illinois described these. Trash them, and the random-named .plist in ~/Library/LaunchAgents.

5. 5

   Check the system folders and cron

   Open /Library/Application Support, /Library/LaunchAgents and /Library/LaunchDaemons the same way and delete entries tied to the removed app. A .plist is a settings file telling macOS what to start, which is how adware returns. SentinelOne also found a scheduled job, so run crontab -l and look for a line running a file from Application Support.

6. 6

   Restart and repeat

   SentinelOne notes that with several persistence methods it can take more than one try. Restart, check Activity Monitor and the folders, and do it a second time.