Shield for Safari on Mac: what it is and how to remove it
Shield for Safari is not an Apple product, and it is even considered a part of the scam since such pop-ups and redirects attempt to trick people into paying for tech support members or connect users to infected web pages. The pop-up appears on the screen and encourages people to activate the Shield of security. This page covers it on macOS.
Facts checked October 7, 2026. Removal steps checked against Apple's current documentation and the security vendors' reports. We have not run the malware on a Mac. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your Mac is infected.
Fortect for Mac scans for malware and unwanted programs, and its free scan shows what it finds before you decide anything.
An automatic scan checks installed programs, startup items and browser extensions for anything that came with Shield for Safari.
Do it yourself · free Remove Shield for Safari yourself 7 steps, about 21 minutes, no software needed.
Start the steps
Shield for Safari: summary
| Distribution | Such adware-type intruders get distributed with the help of other PUPs, deceptive pages, and shady promotional pop-ups shown on those websites. By clicking on various online material that is not safe you can trigger downloads of potentially dangerous applications |
|---|---|
| Name | Shield for Safari |
| Type | Mac malware/ Scam |
| Symptoms | Fake banners on various sites and pop-up messages appear pushing updates of the questionable application or Safari browser. Third-party programs get installed out of nowhere, and user encounters more messages from alleged technical support team members that suggest contacting people from Apple |
| Danger | Contact held between scammers and the PC user can lead to loss of data or money when the person on the other side requires payment for the provided help. Also, various commercial content that appears on the system can lead to malicious sites and malware infections, or exposed personal information, and data tracking issues[2] |
| Tactics | Social engineering and technical support scam techniques get employed in this campaign where shady Safari and OS updates get promoted |
| Removal | Scan the Mac with security software to find the malware and anything installed with it. Fortect for Mac scans for malware and unwanted programs. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 5 more facts
| Detection names | No Microsoft detection name is known |
|---|---|
| Damage | Not recorded in the old report |
| Evidence | 4 write-ups by security sites; details still limited |
| First seen | 17 December 2019 |
| Facts checked | 7 October 2026 |
What Shield for Safari does on an infected Mac
From our report of Dec 2019 · not reviewed since
Shield for Safari is the application name appearing on suspicious pop-ups as a suggestion to update the safety of your Safari browser
Shield for Safari is not an Apple product, and it is even considered a part of the scam since such pop-ups and redirects attempt to trick people into paying for tech support members or connect users to infected web pages. The pop-up appears on the screen and encourages people to activate the Shield of security.
The agreement leads to loss of money, or even installation of shady tools, malware that affects your device further. In most cases, such content appears out of nowhere when people have no idea about the application itself but receive the update notification. This fake alert reminds of another Mac malware that works on a similar principle and shows a scammy message - Safari-protection.com.
Since there is no particular Shield for Safari application on the system when the pop-up appears, the update itself raises questions. Fortunately, if you exit the window and don't activate any updates or downloads, you can safely browse online and use the machine further. Any interaction with the pop-up leads to more ad-supported sites where PUPs can get distributed, in a result, your machine more affected by cyber intruders.
You should avoid such suspicious content and exit any shady pop-up, especially when software, updates, and other content is promoted. You can exit the window and avoid the infection, but an additional system check should ensure that there is no PUP running in the background.
Shield for Safari is probably developed by scammers who aim to get users' information, gain profit from them by redirecting or even directly claiming the payment for questionable technical help. You may receive the pop-up while browsing a common site on your Google Chrome, Safari, Mozilla Firefox, or another browser.
It is even more suspicious and bizarre when the pop-up on Chrome suggests installing anything for your Safari, but pop-up can promote updates for your Mac OS directly. Unfortunately, people still fall for this scam.
Shield for Safari can be categorized as an adware or ad-supported program because the initial purpose of these pop-ups, banners, and redirects is to reroute the online traffic to malicious pages or sites where ad-tracking is the main goal and functionality.
Shield for Safari advertisements show up intrusively and cause other redirects so you cannot exit the initial page and keep visiting associated sites. Unfortunately, there is more to this technique because ad-supported sites include tracking technologies, and each page visit not only generates revenue for the publisher but also reveals details about users browsing habits and preferences.
You need to consider this feature as dangerous and try to remove Shield for Safari to end all the annoying symptoms of the adware. However, since the particular application cannot be located, you need to scan the system fully with a compatible anti-malware program that checks various places of your computer and indicates all the possible issues.
The most important thing that you need to note about the shady Shield for Safari or any other scammy campaigns is to ignore any content that raises questions and appears out of nowhere.
When the banner or a pop-up suggests allowing additional content, activating the installation or updating any software, you should be aware of possible danger. Remember that Apple and other software developers don't show random messages on the browser. All updates should be checked in Settings> General> Software updates only.
Since application related to the intrusive adware activity may be hidden, the process of Shield for Safari removal becomes more difficult and requires employing professional anti-malware tools for help. You can find a program compatible with macOS that is capable of scanning the system fully to indicate malicious apps.
However, many places of the machine itself, settings, and programs or functions may still be affected by Shield for the Safari virus. For that reason, various experts recommend getting a system tool, repair on cleaning utility like that may find and fix all the issues for you without any further damage.
Don't get surprised when your web browsers get changed or questionable content appears installed out of nowhere. Once adware like Shield for Safari lands on the machine, it can affect your browsing by setting the homepage or search engine to a suspicious site, installing in-browser tools, extensions. This is why we have a more in-depth guide below for browser resetting for you down below.
From our report of Dec 2019 · not reviewed since
Various sorts of software installations disguise shady utilities
Programs that flood your browser with numerous advertisements and content generating redirects to additional pages come from the internet because various deceptive websites deliver software on the machine that is not useful in any shape or form. - PUPs. System cleaning programs get promoted online with all the alleged claims, while in reality, such programs waste your time and sometimes money.
Various pop-ups with interactive buttons that suggest to unlock or allow content also trigger automated downloads of such adware and hijacker applications. The sole objective of these apps is to display more advertising content that reroutes you to scammy pages.
If you install anything from the internet or such alert about the download required appears on the screen, you need to take the advantage in your hands and choose Custom or Advanced options of the installation to check all the files and programs prepared to get launched on the machine. This way, you control what apps get to be installed and which ones get deleted entirely.
From our report of Dec 2019 · not reviewed since
More from our earlier report on Shield for Safari
- To remove Shield for Safari from the machine, get anti-malware tool compatible with your device
- You should also tackle the damage this suspicious program can cause, so or a similar repair program might offer the performance improving function
How to remove Shield for Safari
How to remove Shield for Safari from a Mac
Start with the passwords and crypto, from another device: a stealer copies them in seconds.
Then clean the Mac, or erase it.
Step 1: Change passwords from another device first
If you pasted a command into Terminal or opened a downloaded file from Shield for Safari, assume the passwords saved in the browsers and in Keychain on this Mac are known to the attacker.
From a phone or a clean computer, change the e-mail password first, then banking, shopping, social and work accounts, and sign out of all other sessions on each one.
Move any cryptocurrency to a new wallet created on a clean device, because a seed phrase that was stored on this Mac is compromised. Do this before cleaning the Mac: cleaning does not undo the theft.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Step 2: Quit what is running that you do not recognize
Open Activity Monitor (in Applications > Utilities, or search for it with Command + Space).
In the CPU or Network tab, look for a process you did not install or whose name is random, select it, click the stop button (the octagon with an X) and choose Quit or Force Quit.
Note the name first: you will look for the same name in the next steps. Malware that comes back after a restart is handled in the next two steps.
Step 3: Remove unknown login items and background items
Open System Settings > General > Login Items & Extensions. Under Open at Login and Allow in the Background, switch off or remove anything you do not recognize, especially items whose developer is shown as an unknown name or that appeared on the day you ran the command.
Then open Finder, choose Go > Go to Folder and check
~/Library/LaunchAgents,/Library/LaunchAgentsand /Library/LaunchDaemons for property list (.plist) files you did not add. Drag suspicious ones to the Bin, then restart the Mac.Step 4: Delete apps and downloads you did not intend to install
Open the Applications folder and your Downloads folder. Drag any app you did not install, and any disk image (
.dmg), installer (.pkg) or archive (.zip) that came from Shield for Safari or a site you do not trust, to the Bin, then empty the Bin.Also check
~/Library/Application Supportfor a folder with the same name as the app you removed.Step 5: Check the browsers for extensions and changed settings
In Safari open Settings > Extensions and General (homepage). In Chrome open
chrome://extensions, in Firefoxabout:addons.Remove any extension you did not add, and reset the homepage and search engine if they changed. Browsers hold saved passwords and cookies, which is why the password step comes first.
Step 6: If it was an infostealer, erase and reinstall macOS
Stealers copy data and often leave persistence you cannot be sure you found.
The only complete fix is to back up your personal files only (documents, photos, not apps or settings), then open System Settings > General > Transfer or Reset > Erase All Content and Settings, or use macOS Recovery to erase the disk and reinstall macOS, as Apple describes in its support articles.
Restore only your files afterwards, and install apps again from their official sources.
Step 7: Report it and watch your accounts
Report the site and the command to the authorities in your country, and tell your bank if any card was saved in a browser or in Keychain.
Over the next weeks watch your e-mail, bank and exchange accounts for sign-ins and transfers you did not make. Keep the notes you made, such as the process names and the file dates, in case a bank or the police ask for them.
Full procedure with screenshots: Report a cyber attack or scam to the authorities
Instructions for each browser and system
The detailed steps for every browser and system this guide covers. Open the one you use.
Remove from Google Chrome
Delete malicious extensions from Google Chrome:
- Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
- In the newly opened window, you will see all the installed extensions. Uninstall all suspicious extensions related to the unwanted program by clicking Remove.
Clear cache and web data from Chrome:
- Click on Menu and pick Settings.
- Under Privacy and security, select Clear browsing data.
- Select Browsing history, Cookies and other site data, as well as Cached images and files.
- Click Clear data.
Change your homepage:
- Click menu and choose Settings.
- Look for a suspicious site in the On startup section.
- Click on Open a specific or set of pages and click on three dots to find the Remove option.
Reset Google Chrome:
If the previous methods did not help you, reset Google Chrome to eliminate all the unwanted components:
- Click on Menu and select Settings.
- In the Settings, scroll down and click Advanced.
- Scroll down and locate Reset and clean up section.
- Now click Restore settings to their original defaults.
- Confirm with Reset settings.
Remove from Mozilla Firefox (FF)
Remove dangerous extensions:
- Open Mozilla Firefox browser and click on the Menu (three horizontal lines at the top-right of the window).
- Select Add-ons.
- In here, select the unwanted extension and click Remove.
Reset the homepage:
- Click three horizontal lines at the top right corner to open the menu.
- Choose Settings.
- Under Home, set your preferred homepage and new tab settings.
Clear cookies and site data:
- Click Menu and pick Settings.
- Go to Privacy & Security section.
- Scroll down to locate Cookies and Site Data.
- Click on Clear Data...
- Select Cookies and Site Data and Temporary cached files and pages, then click Clear.
Reset Mozilla Firefox
If clearing the browser as explained above did not help, reset Mozilla Firefox:
- Open Mozilla Firefox browser and click the Menu.
- Go to Help and then choose Troubleshooting Information.
- Under Give Firefox a tune up section, click on Refresh Firefox...
- Once the pop-up shows up, confirm the action by pressing on Refresh Firefox.
Delete from Safari
You should check the browser for any suspicious material and apps installed without your permission or knowledge
Remove dangerous extensions:
- Open Safari, click Safari in the menu at the top-left of the screen, and select Preferences.
- Go to the Extensions tab, look for any suspicious entries, and click Uninstall to remove them.
Clear history and website data:
- Click Safari in the menu and pick Clear History.
- Set Clear to all history and confirm with Clear History.
Reset Safari:
- Click Safari in the menu and select Preferences > Advanced.
- Enable Show Develop menu in menu bar.
- From the menu bar, click Develop and select Empty Caches.
Delete from macOS
Run through important parts of the OS to get rid of the Shield for Safari or follow these steps:
Remove the unwanted application:
- From the menu bar, select Go > Applications.
- In the Applications folder, look for any suspicious entries, then drag them to Trash (or right-click and pick Move to Trash).
Delete leftover files and folders:
- Select Go > Go to Folder.
- Enter /Library/Application Support and remove any suspicious folders related to the unwanted program.
- Repeat the same check in the /Library/LaunchAgents and /Library/LaunchDaemons folders, deleting any suspicious entries.
- Finally, empty the Trash to permanently remove the leftovers.
From our report of Dec 2019 · not reviewed since
Get rid of shady applications and make sure to eliminate Shield for Safari fully to avoid infections
There is no need to call this application and adware campaign a Shield for Safari virus because there is no damage to the system this PUP could cause.
However, there is nothing that should keep you from deleting the program from the machine entirely.
You need to remove Shield for Safari not by exiting the pop-up with an update notifications but by employing a professional anti-malware tool compatible with macOS devices. You need such software for a proper system scan because PUPs are silent intruders and can be set to install core files in multiple folders.
When this is done, you need to remove all files associated with the PUP to end the annoying redirects and fake alert pop-ups. So get anti-malware tools and perform a quick Shield for Safari removal automatically when the AV program indicates possible intruders for you. Additionally, go through our tips below to ensure that the machine is running normally.
After removal: passwords, accounts and prevention
Your passwords after Shield for Safari
Removing Shield for Safari does not undo what it may already have sent out while the PC showed shield for Safari in the list of installed apps.
Treat saved browser passwords and logged-in sessions on this PC as known to the attacker.
From another device, change the e-mail password first and end all its sessions. Then do the same for the bank, PayPal, Microsoft, Google and Apple accounts. Stolen session cookies keep working after a password change until you sign out everywhere.
Move crypto to a new wallet created on a clean device. A step-by-step order for every kind of account is in our guide to account security after an infection.
Access your website securely from any location
When you work on the domain, site, blog, or different project that requires constant management, content creation, or coding, you may need to connect to the server and content management service more often. The best solution for creating a tighter network could be a dedicated/fixed IP address.
If you make your IP address static and set to your device, you can connect to the CMS from any location and do not create any additional issues for the server or network manager that needs to monitor connections and activities. VPN software providers like can help you with such settings and offer the option to control the online reputation and manage projects easily from any part of the world.
Recover files after data-affecting malware attacks
While much of the data can be accidentally deleted due to various reasons, malware is one of the main culprits that can cause loss of pictures, documents, videos, and other important files.
More serious malware infections lead to significant data loss when your documents, system files, and images get encrypted. In particular, ransomware is is a type of malware that focuses on such functions, so your files become useless without an ability to access them.
Even though there is little to no possibility to recover after file-locking threats, some applications have features for data recovery in the system. In some cases, can also help to recover at least some portion of your data after data-locking virus infection or general cyber infection.
Questions about Shield for Safari
What is Shield for Safari and why is it on my PC?
Shield for Safari is a program that was installed on the PC, most likely together with something else you downloaded. Free software sites and many installers add extra programs on setup pages with pre-ticked boxes, so the extra install looks like your choice even though nobody read the page.
Check the install date in Settings, Apps, Installed apps: the program you installed that day is the probable carrier. If you do not need Shield for Safari, uninstall it. If it belongs to your hardware or to a program you use, search its exact name and publisher first, because drivers and their tools can have unfamiliar names.
How do I stop programs like Shield for Safari from being installed again?
Most unwanted programs arrive through installers, so the fix is in how you install software. Download programs from their official sites or the Microsoft Store, not from download portals or ads above search results. During setup, choose Custom or Advanced installation and untick every extra offer, including browsers, toolbars and optimizers.
Decline update prompts that appear inside other programs unless you know them. In Windows Security, turn on reputation-based protection and potentially unwanted app blocking. These steps would most likely have stopped Shield for Safari before it reached the app list.
Is a trojan infection worth reporting to the police?
If there was harm, yes. Unauthorised payments, accounts used for fraud, blackmail or a remote session during a scam call all belong in a report, and banks often ask for its reference number before they refund anything.
If antivirus caught Shield for Safari before it ran and nothing was misused, there is nothing to report. Keep the evidence anyway:
- protection history
- the original download
- the dates
Businesses may also have to notify a data protection authority if personal data could have been accessed.
Why can't I find Shield for Safari in antivirus databases?
Because it is new or because it is listed under a different name. Antivirus companies name threats after the family they belong to, and a program that appears as Shield for Safari on your PC may carry a generic or unrelated label in their databases.
Many new samples are first detected only by behaviour, without a family name. What you saw, shield for Safari in the list of installed apps, is enough to act on:
- end the program
- remove its startup entry
- run a Microsoft Defender offline scan
- secure your accounts
A detection name from a scan is worth noting for later.
Can a normal remote support program be a backdoor?
Yes. Tools such as AnyDesk, TeamViewer and ScreenConnect are legitimate, but whoever controls the account behind them controls the PC. Scammers install them during fake support calls, and some trojan campaigns install them silently because antivirus programs do not flag a genuine, signed product.
If you find one you did not set up, uninstall it, check Startup apps for related entries and change passwords from another device. If money or accounts were involved, call your bank and report the incident.
What are the signs of a trojan infection?
Most trojans try to leave no visible signs, so look for side effects. Common ones:
- Windows Security turned off or unable to update
- new entries in Startup apps or Task Scheduler
- programs in Installed apps you did not install
- browser settings that changed by themselves
- unusual network activity while the PC is idle
- password-reset or login-alert e-mails you did not trigger
None of these proves an infection on its own. Together with an antivirus alert naming Shield for Safari, they are a strong reason to follow the full plan.
Is it safe to do online banking after seeing shield for Safari in the list of installed apps?
Not on that PC until it is clean. A program that produces shield for Safari in the list of installed apps runs with your rights and could read what you type or what the browser shows. Use a phone or another computer for banking and for changing passwords.
When the offline scan of the affected PC is clean and nothing suspicious starts with Windows any more, you can go back to using it. Check your bank statements for the past weeks either way, and call the bank if anything looks unfamiliar; banks can block cards and reset access quickly.
Why didn't my antivirus stop Shield for Safari?
New trojan builds are packed and changed often so that signatures do not match, and some are signed with stolen or bought certificates. Many arrive inside password-protected archives, which scanners cannot open until you extract them.
Some downloads also tell the user to turn off the antivirus "because it gives false alarms", a common line in cracked software instructions. Keep real-time protection on, never disable it for an installer, and run the offline scan whenever you suspect something slipped through.
Can Shield for Safari spread to other devices on my network?
Most trojans aimed at home users stay on the PC they infected, but an attacker with remote access can look at the network, open shared folders and try passwords on other devices. Loaders sometimes deliver worms or ransomware that do spread.
Disconnect the PC while cleaning, run a full scan on other Windows PCs, change the router's admin password and the Wi-Fi password if they were saved on the infected PC, and update the router's firmware. If other PCs show the same detection, treat them as infected too.
Will Fortect remove Shield for Safari?
Fortect for Mac scans for malware and unwanted programs, and its free scan shows what it finds on your Mac before you decide anything.
For Shield for Safari, follow the plan on this page as well: removing a launch item or an app is done in macOS itself, and a scanner cannot undo what was typed or entered on the infected Mac, such as saved passwords that were copied.
Change your passwords from another device first, and if the page tells you to erase the Mac, a scan is not a substitute. The free scan costs nothing and the full-featured product needs a license.
Sources
- Discussions: Just received a "Shield for Safari" update. Is this a valid update? (read October 7, 2026)
- Theverge: Ad tracking on Iphone (read October 7, 2026)
- Virusai: Virusai (read October 7, 2026)
- FTC: How to recognize, remove and avoid malware (read October 7, 2026)
- Microsoft Learn: Microsoft Defender Offline (read October 7, 2026)